CVE-2026-77508 | Low | 3.5 | 2026-08-26 | Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/u… |
CVE-2026-13267 | High | 8.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-5423 | | | 2026-08-06 | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription… |
CVE-2026-50528 | High | 8.2 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-48117 | Medium | 6.8 | 2026-06-17 | DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an… |
CVE-2026-48781 | Critical | 9.9 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio… |
CVE-2026-34460 | Medium | 5.4 | 2026-06-02 | NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-sid… |
CVE-2025-43992 | Medium | 5.6 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerabi… |
CVE-2026-28510 | Medium | 5.9 | 2026-05-05 | eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication… |
CVE-2026-40285 | High | 8.8 | 2026-04-17 | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu… |
CVE-2026-39429 | High | 8.2 | 2026-04-08 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server i… |
CVE-2026-27840 | Medium | 4.3 | 2026-02-26 | ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2… |
CVE-2024-45370 | High | 7.3 | 2025-12-01 | An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-8855 | High | 8.1 | 2025-11-14 | Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln… |
CVE-2025-47158 | Critical | 9.0 | 2025-07-18 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-20285 | Medium | 4.1 | 2025-07-16 | A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP acces… |
CVE-2025-46647 | Medium | 5.3 | 2025-07-02 | A vulnerability of plugin openid-connect in Apache APISIX.
This vulnerability will only have an impact if all of the following conditions are met:
1. Use the… |
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-26522 | | | 2025-02-14 | This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker w… |
CVE-2025-24876 | High | 8.1 | 2025-02-11 | The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t… |
CVE-2024-56404 | Critical | 9.9 | 2025-01-24 | In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa… |
CVE-2024-12838 | High | 8.8 | 2024-12-31 | The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regu… |
CVE-2024-43441 | Critical | 9.8 | 2024-12-24 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.
This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0… |
CVE-2024-8475 | Medium | 6.5 | 2024-12-17 | Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables.
This iss… |
CVE-2024-49056 | High | 7.3 | 2024-11-12 | Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network. |
CVE-2024-47086 | Medium | 6.5 | 2024-09-19 | This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authentica… |
CVE-2024-3462 | Medium | 5.4 | 2024-05-14 | Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-ad… |
CVE-2024-4024 | High | 7.3 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versi… |
CVE-2024-3741 | High | 7.5 | 2024-04-18 | Electrolink transmitters are vulnerable to an authentication bypass
vulnerability affecting the login cookie. An attacker can set an
arbitrary value except '… |
CVE-2024-22179 | High | 7.5 | 2024-04-18 | The application is vulnerable to an unauthenticated parameter
manipulation that allows an attacker to set the credentials to blank
giving her access to the a… |
CVE-2023-47127 | Medium | 4.2 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site… |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass.
This issue affects SYSGuard 3001: before… |
CVE-2022-3875 | High | 7.3 | 2022-12-19 | A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown… |
CVE-2022-40703 | Medium | 5.2 | 2022-10-26 | CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior
on Android allows an unauthenticated attack… |
CVE-2022-2503 | Medium | 6.9 | 2022-08-12 | Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root f… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2021-1561 | Medium | 5.4 | 2021-08-18 | A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authen… |
CVE-2021-1399 | Medium | 4.3 | 2021-04-08 | A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Editio… |
CVE-2020-15074 | High | 7.5 | 2020-07-14 | OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making… |
CVE-2016-9482 | Critical | 9.8 | 2018-07-13 | Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigatin… |