CVE-2026-93582 | Critical | 9.4 | 2026-10-12 | The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_US… |
CVE-2026-62367 | | | 2026-10-09 | Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback`… |
CVE-2026-96336 | High | 7.5 | 2026-10-09 | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57… |
CVE-2026-96333 | High | 7.5 | 2026-10-09 | Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16… |
CVE-2026-107336 | Medium | 6.5 | 2026-10-08 | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A re… |
CVE-2026-107589 | High | 7.5 | 2026-10-08 | Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names. |
CVE-2026-4894 | | | 2026-10-08 | A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses… |
CVE-2026-87663 | | | 2026-10-08 | An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d an… |
CVE-2026-87686 | | | 2026-10-08 | An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web di… |
CVE-2026-87670 | | | 2026-10-08 | An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management… |
CVE-2026-92542 | | | 2026-10-07 | The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams se… |
CVE-2026-33586 | | | 2026-10-07 | Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from” and “From” fields when sending
emails through OVH mail servers.
Due to OVH… |
CVE-2026-97146 | | | 2026-10-07 | Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yun… |
CVE-2026-102161 | High | 8.8 | 2026-10-06 | An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers)… |
CVE-2026-105863 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a r… |
CVE-2026-97308 | Medium | 4.8 | 2026-10-06 | Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. |
CVE-2026-39772 | Medium | 5.3 | 2026-10-06 | Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions. |
CVE-2026-105057 | Medium | 5.3 | 2026-10-06 | Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. |
CVE-2026-41558 | High | 7.5 | 2026-10-06 | Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions. |
CVE-2026-105741 | High | 7.1 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Proto… |
CVE-2026-105640 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployme… |
CVE-2026-104891 | High | 7.5 | 2026-10-05 | mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx… |
CVE-2026-103512 | | | 2026-10-05 | Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server t… |
CVE-2026-105215 | Critical | 9.1 | 2026-10-04 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration e… |
CVE-2026-104988 | High | 8.1 | 2026-10-02 | A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth… |
CVE-2026-94422 | High | 8.8 | 2026-10-02 | An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-B… |
CVE-2026-104733 | | | 2026-10-02 | User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLA… |
CVE-2026-104445 | High | 8.2 | 2026-10-02 | YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the acti… |
CVE-2026-103347 | Medium | 5.3 | 2026-10-01 | Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions. |
CVE-2026-103397 | Medium | 5.6 | 2026-09-30 | OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing… |
CVE-2026-97274 | Critical | 9.8 | 2026-09-30 | Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. |
CVE-2026-97249 | Medium | 5.3 | 2026-09-30 | Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. |
CVE-2026-96825 | Medium | 4.2 | 2026-09-30 | Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions. |
CVE-2026-92899 | Medium | 4.8 | 2026-09-30 | Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentica… |
CVE-2026-101280 | High | 7.3 | 2026-09-29 | A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Reco… |
CVE-2026-93538 | High | 7.1 | 2026-09-28 | A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registerin… |
CVE-2026-100390 | High | 7.4 | 2026-09-25 | Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers con… |
CVE-2026-84465 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email… |
CVE-2026-94416 | Medium | 6.8 | 2026-09-24 | An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new servi… |
CVE-2026-95524 | Medium | 5.3 | 2026-09-23 | Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-95523 | Medium | 6.5 | 2026-09-23 | Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
CVE-2026-94457 | Medium | 4.8 | 2026-09-23 | Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. |
CVE-2026-93511 | Medium | 5.3 | 2026-09-23 | The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowi… |
CVE-2026-92929 | Medium | 5.3 | 2026-09-23 | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request sour… |
CVE-2026-37604 | Medium | 6.5 | 2026-09-22 | pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP an… |
CVE-2026-55210 | High | 7.4 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin()… |
CVE-2026-63329 | Medium | 4.9 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a… |
CVE-2026-62987 | Medium | 5.8 | 2026-09-21 | Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses p… |
CVE-2026-85751 | Critical | 9.8 | 2026-09-21 | Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH… |
CVE-2026-61682 | Critical | 9.9 | 2026-09-18 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-prox… |
CVE-2026-85511 | Medium | 4.2 | 2026-09-18 | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter… |
CVE-2026-69843 | Critical | 10.0 | 2026-09-18 | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-77903 | Critical | 9.0 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-76949 | | | 2026-09-17 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser… |
CVE-2026-91039 | | | 2026-09-17 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynami… |
CVE-2026-86863 | Critical | 9.8 | 2026-09-17 | pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered throug… |
CVE-2026-86039 | High | 8.2 | 2026-09-17 | libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses con… |
CVE-2026-62108 | Critical | 9.8 | 2026-09-17 | Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. |
CVE-2026-20071 | Low | 3.8 | 2026-09-16 | A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboa… |
CVE-2026-76423 | Critical | 10.0 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected dev… |
CVE-2026-92395 | Critical | 9.1 | 2026-09-16 | @fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request… |
CVE-2026-40854 | | | 2026-09-16 | WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly valid… |
CVE-2026-89327 | Low | 3.8 | 2026-09-16 | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing an… |
CVE-2026-15640 | | | 2026-09-16 | Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. |
CVE-2026-89022 | High | 7.4 | 2026-09-15 | BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as… |
CVE-2026-59157 | Medium | 6.5 | 2026-09-15 | webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without… |
CVE-2026-49446 | Medium | 6.1 | 2026-09-15 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tok… |
CVE-2026-90711 | Critical | 9.1 | 2026-09-15 | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions… |
CVE-2026-73449 | Medium | 5.9 | 2026-09-14 | On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privile… |
CVE-2026-65399 | Medium | 4.4 | 2026-09-14 | A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, mac… |
CVE-2026-18065 | Medium | 5.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigat… |
CVE-2026-88819 | | | 2026-09-14 | In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. |
CVE-2026-21391 | | | 2026-09-14 | An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. I… |
CVE-2026-87785 | Critical | 9.1 | 2026-09-14 | Authentication bypass by spoofing vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least… |
CVE-2025-68624 | Medium | 4.3 | 2026-09-14 | N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM… |
CVE-2026-90447 | Medium | 6.5 | 2026-09-11 | A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header… |
CVE-2026-45056 | | | 2026-09-11 | matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and pr… |
CVE-2026-63427 | High | 7.8 | 2026-09-10 | An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution wi… |
CVE-2026-88011 | High | 8.1 | 2026-09-10 | Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Auth… |
CVE-2026-66674 | Medium | 5.6 | 2026-09-10 | Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. |
CVE-2026-88879 | High | 8.2 | 2026-09-10 | Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on… |
CVE-2026-82563 | High | 7.6 | 2026-09-09 | An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status r… |
CVE-2026-82530 | Medium | 5.3 | 2026-09-09 | IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to… |
CVE-2026-62759 | High | 7.5 | 2026-09-08 | Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2026-77089 | Critical | 9.8 | 2026-09-08 | Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update… |
CVE-2026-86478 | Critical | 9.8 | 2026-09-07 | In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asse… |
CVE-2026-84186 | | | 2026-09-07 | Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via t… |
CVE-2026-86196 | | | 2026-09-05 | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated atta… |
CVE-2026-85432 | High | 8.2 | 2026-09-03 | MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other cli… |
CVE-2026-84849 | Medium | 6.5 | 2026-09-03 | Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. |
CVE-2026-84766 | Medium | 5.9 | 2026-09-03 | Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. |
CVE-2026-82180 | | | 2026-09-03 | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.50… |
CVE-2026-19117 | Critical | 9.8 | 2026-09-02 | Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as
that user. This i… |
CVE-2026-14199 | High | 7.1 | 2026-09-02 | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache… |
CVE-2026-84479 | Critical | 9.1 | 2026-09-01 | WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncode… |
CVE-2026-84476 | High | 7.5 | 2026-09-01 | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by en… |
CVE-2026-73742 | Medium | 4.3 | 2026-09-01 | A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attri… |
CVE-2026-58575 | High | 8.8 | 2026-09-01 | Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate… |
CVE-2026-82228 | High | 8.1 | 2026-08-31 | Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. |
CVE-2026-13735 | Low | 3.7 | 2026-08-28 | Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data… |