CVE-2026-49467 | High | 8.8 | 2026-08-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password v… |
CVE-2026-66411 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.
An unauthenticated attacker may connect and ope… |
CVE-2026-11430 | High | 7.3 | 2026-08-07 | Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is co… |
CVE-2026-10050 | Critical | 9.1 | 2026-08-04 | In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specifi… |
CVE-2026-59309 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit th… |
CVE-2026-66028 | Medium | 6.7 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create dupli… |
CVE-2026-57852 | Medium | 5.6 | 2026-07-20 | Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled… |
CVE-2026-47300 | High | 8.8 | 2026-07-14 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-50360 | High | 8.8 | 2026-07-14 | Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-41053 | High | 8.8 | 2026-06-30 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any log… |
CVE-2026-12773 | High | 7.3 | 2026-06-21 | A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth… |
CVE-2026-50627 | Critical | 9.1 | 2026-06-12 | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one R… |
CVE-2026-46389 | Critical | 10.0 | 2026-06-05 | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0… |
CVE-2026-46595 | Critical | 10.0 | 2026-05-22 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key… |
CVE-2026-8922 | Medium | 5.4 | 2026-05-19 | A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspec… |
CVE-2026-41103 | Critical | 9.1 | 2026-05-12 | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges ov… |
CVE-2026-43640 | High | 8.1 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an… |
CVE-2026-35579 | Critical | 9.8 | 2026-05-05 | CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authenticat… |
CVE-2026-33190 | High | 7.5 | 2026-05-05 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and… |
CVE-2026-0073 | High | 8.8 | 2026-05-04 | In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remo… |
CVE-2026-33557 | Critical | 9.1 | 2026-04-20 | A possible security vulnerability has been identified in Apache Kafka.
By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.a… |
CVE-2026-27656 | Medium | 5.7 | 2026-03-25 | Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUse… |
CVE-2026-32953 | Medium | 4.6 | 2026-03-20 | Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out… |
CVE-2026-29515 | Critical | 9.8 | 2026-03-11 | MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without… |
CVE-2026-28446 | Critical | 9.4 | 2026-03-05 | OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist pol… |
CVE-2019-25436 | Medium | 6.5 | 2026-02-20 | Sricam DeviceViewer 3.12.0.1 contains a password change security bypass vulnerability that allows authenticated users to change passwords without proper valida… |
CVE-2026-0999 | Medium | 5.4 | 2026-02-16 | Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated us… |
CVE-2020-37094 | High | 8.1 | 2026-02-03 | EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by ex… |
CVE-2025-14510 | High | 8.1 | 2026-01-16 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 befo… |
CVE-2025-4676 | High | 8.8 | 2026-01-07 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-14273 | High | 7.2 | 2025-12-22 | Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions… |
CVE-2025-66489 | Critical | 9.8 | 2025-12-03 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a… |
CVE-2025-13390 | Critical | 10.0 | 2025-12-03 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of… |
CVE-2025-12421 | Critical | 9.9 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange… |
CVE-2025-12419 | Critical | 9.9 | 2025-11-27 | Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Conn… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-53782 | High | 8.4 | 2025-10-14 | Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-61783 | | | 2025-10-09 | Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail e… |
CVE-2025-43727 | High | 7.5 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-57808 | High | 8.1 | 2025-09-02 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server aut… |
CVE-2025-8881 | Medium | 6.5 | 2025-08-13 | Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2025-43856 | | | 2025-07-11 | immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, becau… |
CVE-2025-44557 | High | 8.1 | 2025-06-27 | A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authenticatio… |
CVE-2025-48994 | | | 2025-06-02 | SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared… |
CVE-2025-3230 | Medium | 5.4 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deact… |
CVE-2025-2571 | Medium | 4.2 | 2025-05-30 | Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user account… |
CVE-2025-2475 | Medium | 5.4 | 2025-04-14 | Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an… |
CVE-2024-8314 | | | 2025-03-25 | An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL… |
CVE-2025-23046 | High | 7.5 | 2025-02-25 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is… |
CVE-2025-21311 | Critical | 9.8 | 2025-01-14 | Windows NTLM V1 Elevation of Privilege Vulnerability |
CVE-2024-56128 | Medium | 5.3 | 2024-12-18 | Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation.
Issue Summary:
Apache Kafka's implementation of the Salted Challe… |
CVE-2024-52586 | Medium | 5.4 | 2024-12-09 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that a… |
CVE-2024-10127 | Critical | 9.8 | 2024-11-20 | Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user aut… |
CVE-2024-9999 | Medium | 6.5 | 2024-11-12 | In WS_FTP Server versions before 8.8.9 (2022.0.9), an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the… |
CVE-2024-36250 | Low | 3.1 | 2024-11-09 | Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code w… |
CVE-2024-10214 | Low | 3.5 | 2024-10-28 | Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorre… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-25157 | Medium | 6.5 | 2024-08-14 | An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission check… |
CVE-2024-7593 | Critical | 9.8 | 2024-08-13 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a… |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2023-4860 | Critical | 9.6 | 2024-07-16 | Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2024-34722 | High | 8.8 | 2024-07-09 | In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a protocol. This could l… |
CVE-2024-5658 | Medium | 4.8 | 2024-06-06 | The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period. |
CVE-2024-4332 | | | 2024-06-03 | An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use L… |
CVE-2024-4985 | Critical | 9.8 | 2024-05-20 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional e… |
CVE-2024-35190 | Medium | 5.8 | 2024-05-17 | Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpo… |
CVE-2023-44420 | High | 8.8 | 2024-05-03 | D-Link DIR-X3260 prog.cgi Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent… |
CVE-2023-34282 | High | 8.8 | 2024-05-03 | D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2023-34274 | High | 8.8 | 2024-05-03 | D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjac… |
CVE-2023-32152 | Medium | 6.5 | 2024-05-03 | D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affect… |
CVE-2023-32148 | Medium | 6.5 | 2024-05-03 | D-Link DIR-2640 HNAP PrivateLogin Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affecte… |
CVE-2024-32879 | Medium | 4.9 | 2024-04-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB dat… |
CVE-2024-26248 | High | 7.5 | 2024-04-09 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2024-3046 | High | 7.5 | 2024-04-09 | In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to re… |
CVE-2021-42146 | High | 7.5 | 2024-01-24 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two tim… |
CVE-2023-31211 | High | 8.8 | 2024-01-12 | Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials |
CVE-2023-4641 | Medium | 4.7 | 2023-12-27 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-uti… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-39953 | Medium | 4.8 | 2023-08-10 | user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing ve… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |
CVE-2023-29357 | Critical | 9.8 | 2023-06-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2023-29129 | Critical | 9.1 | 2023-06-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >… |
CVE-2022-41985 | High | 8.6 | 2023-05-10 | An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network pack… |
CVE-2022-43635 | Medium | 6.5 | 2023-03-29 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) route… |
CVE-2023-25957 | Critical | 9.1 | 2023-03-14 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >… |
CVE-2022-4861 | Medium | 4.8 | 2022-12-30 | Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another reso… |
CVE-2022-46146 | Medium | 6.2 | 2022-11-29 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2022-20923 | Medium | 4.0 | 2022-09-08 | A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthent… |
CVE-2022-33736 | High | 7.5 | 2022-07-12 | A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affe… |
CVE-2022-20695 | Critical | 10.0 | 2022-04-15 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass a… |
CVE-2021-21902 | High | 8.1 | 2021-12-22 | An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed n… |
CVE-2021-32691 | High | 8.8 | 2021-06-16 | Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access… |
CVE-2021-21378 | High | 8.2 | 2021-03-11 | Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token wit… |
CVE-2020-15632 | High | 8.8 | 2020-07-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is no… |
CVE-2020-5268 | Medium | 6.5 | 2020-04-21 | In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some c… |
CVE-2020-8863 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-8861 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders… |
CVE-2018-4841 | Critical | 9.8 | 2018-03-29 | A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform a… |
CVE-2016-9463 | High | 8.1 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud inclu… |