CVE-2026-1621 | Medium | 5.3 | 2026-08-14 | Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.
This issue affec… |
CVE-2026-65935 | | | 2026-08-13 | Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value.
See vulnerability B-E3 in the re… |
CVE-2026-19292 | High | 8.8 | 2026-08-13 | Re-pairing with a legitimate device can use a lower security level than
previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. |
CVE-2026-62427 | High | 8.8 | 2026-07-28 | [This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl… |
CVE-2026-9597 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token… |
CVE-2026-9571 | Medium | 5.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allow… |
CVE-2026-35159 | Medium | 5.3 | 2026-07-03 | Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potential… |
CVE-2026-10539 | Critical | 9.0 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauth… |
CVE-2026-41052 | High | 8.8 | 2026-06-29 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6… |
CVE-2025-4994 | | | 2026-06-22 | The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows att… |
CVE-2025-7064 | Medium | 6.6 | 2026-06-11 | Authentication bypass by primary weakness vulnerability in ABB Freelance.
This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1… |
CVE-2026-25555 | Critical | 9.8 | 2026-06-08 | OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attacker… |
CVE-2026-9798 | Medium | 4.3 | 2026-05-28 | A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login at… |
CVE-2026-9047 | High | 7.6 | 2026-05-22 | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's… |
CVE-2026-41054 | High | 7.8 | 2026-05-20 | In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detec… |
CVE-2026-6334 | Low | 3.1 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which all… |
CVE-2026-2652 | High | 8.6 | 2026-05-15 | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authenticat… |
CVE-2026-6266 | High | 8.3 | 2026-05-04 | A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an… |
CVE-2026-4670 | Critical | 9.8 | 2026-04-30 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.
This issue affects MOVEit Automat… |
CVE-2026-40976 | Critical | 9.1 | 2026-04-28 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable… |
CVE-2026-40582 | | | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password… |
CVE-2026-33472 | Medium | 4.8 | 2026-04-16 | Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthori… |
CVE-2026-20152 | Medium | 5.3 | 2026-04-15 | A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker… |
CVE-2026-33892 | High | 7.1 | 2026-04-14 | A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >… |
CVE-2026-40039 | Medium | 6.5 | 2026-04-13 | Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to pa… |
CVE-2026-33496 | High | 8.1 | 2026-03-26 | ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior… |
CVE-2026-3591 | Medium | 5.4 | 2026-03-25 | A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker… |
CVE-2026-30849 | Critical | 9.8 | 2026-03-23 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication byp… |
CVE-2026-32730 | High | 8.1 | 2026-03-18 | ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/in… |
CVE-2025-31703 | | | 2026-03-18 | A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via th… |
CVE-2026-3784 | Medium | 6.5 | 2026-03-11 | curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a
server, even if the new request uses different credentials for the HTTP proxy.
Th… |
CVE-2026-1965 | Medium | 6.5 | 2026-03-11 | libcurl can in some circumstances reuse the wrong connection when asked to do
an Negotiate-authenticated HTTP or HTTPS request.
libcurl features a pool of rec… |
CVE-2026-3047 | High | 8.8 | 2026-03-05 | A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-init… |
CVE-2026-28536 | Critical | 9.6 | 2026-03-05 | Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2026-1713 | Medium | 5.0 | 2026-03-03 | IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9… |
CVE-2026-0869 | High | 8.8 | 2026-03-03 | Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming conf… |
CVE-2026-22153 | High | 8.1 | 2026-02-10 | An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacke… |
CVE-2025-58382 | High | 7.2 | 2026-02-03 | A vulnerability in the secure configuration of authentication and
management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could
allow an authentica… |
CVE-2025-4320 | Critical | 10.0 | 2026-01-23 | Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutio… |
CVE-2025-68609 | Medium | 6.6 | 2026-01-22 | A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default config… |
CVE-2026-1290 | | | 2026-01-21 | Authentication Bypass by Primary Weakness vulnerability in Jamf Jamf Pro allows unspecified impact.This issue affects Jamf Pro: from 11.20 through 11.24. |
CVE-2025-13915 | Critical | 9.8 | 2025-12-26 | IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the… |
CVE-2024-49587 | Critical | 9.1 | 2025-12-19 | Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit gl… |
CVE-2025-68435 | Critical | 9.1 | 2025-12-17 | Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middlewar… |
CVE-2025-51663 | High | 7.5 | 2025-11-19 | A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attemp… |
CVE-2025-41733 | Critical | 9.8 | 2025-11-18 | The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST… |
CVE-2025-47776 | Critical | 9.1 | 2025-11-04 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code… |
CVE-2025-36386 | Critical | 9.8 | 2025-10-28 | IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthoriz… |
CVE-2025-62772 | Low | 3.1 | 2025-10-22 | On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases. |
CVE-2025-59980 | Medium | 6.5 | 2025-10-09 | An Authentication Bypass by Primary Weakness
in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited r… |
CVE-2025-56132 | High | 7.3 | 2025-09-30 | LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable response… |
CVE-2025-59941 | Medium | 5.9 | 2025-09-29 | go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vu… |
CVE-2025-54622 | High | 8.3 | 2025-08-06 | Binding authentication bypass vulnerability in the devicemanager module.
Impact: Successful exploitation of this vulnerability may affect service confidentiali… |
CVE-2025-53534 | | | 2025-08-05 | RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel… |
CVE-2025-31965 | High | 8.2 | 2025-07-29 | Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information… |
CVE-2025-53826 | Critical | 9.8 | 2025-07-15 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version… |
CVE-2025-53167 | Medium | 6.9 | 2025-07-07 | Authentication vulnerability in the distributed collaboration framework module
Impact: Successful exploitation of this vulnerability may affect service confide… |
CVE-2025-52996 | Low | 3.1 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions… |
CVE-2025-46801 | Critical | 9.8 | 2025-05-19 | Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, a… |
CVE-2025-4658 | Critical | 9.8 | 2025-05-13 | Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH… |
CVE-2025-3757 | Critical | 9.8 | 2025-05-13 | Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. |
CVE-2025-46750 | Medium | 4.4 | 2025-05-12 | SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings… |
CVE-2025-41450 | High | 8.2 | 2025-05-08 | Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2 |
CVE-2025-32011 | Critical | 9.8 | 2025-05-01 | KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to… |
CVE-2025-24522 | Critical | 10.0 | 2025-05-01 | KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenti… |
CVE-2025-31161 | Critical | 9.8 | 2025-04-03 | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as ex… |
CVE-2025-31192 | Medium | 6.7 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access… |
CVE-2025-30428 | Medium | 5.4 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Photos in the Hidden Photos Album m… |
CVE-2024-12776 | High | 8.1 | 2025-03-20 | In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any u… |
CVE-2025-1880 | Low | 2.0 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device… |
CVE-2025-27371 | Medium | 6.9 | 2025-03-03 | In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities… |
CVE-2025-27370 | Medium | 6.9 | 2025-03-03 | OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a mali… |
CVE-2025-23017 | Medium | 6.0 | 2025-02-24 | WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user… |
CVE-2024-12054 | Medium | 5.4 | 2025-02-13 | ZF Roll Stability Support Plus (RSSPlus)
is vulnerable to an authentication bypass vulnerability targeting
deterministic RSSPlus SecurityAccess service seeds… |
CVE-2024-42513 | Medium | 5.3 | 2025-02-10 | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoi… |
CVE-2024-51738 | High | 8.1 | 2025-01-20 | Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and… |
CVE-2024-12802 | Critical | 9.1 | 2025-01-09 | SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager… |
CVE-2023-46611 | Medium | 5.3 | 2025-01-02 | Authentication Bypass by Primary Weakness vulnerability in yourownprogrammer YOP Poll allows Authentication Bypass.This issue affects YOP Poll: from n/a throug… |
CVE-2022-48470 | Medium | 4.0 | 2024-12-28 | Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access… |
CVE-2024-12582 | High | 7.1 | 2024-12-24 | A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a use… |
CVE-2021-26102 | Critical | 9.8 | 2024-12-19 | A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete… |
CVE-2023-20154 | Critical | 9.1 | 2024-11-15 | A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface wit… |
CVE-2024-10394 | High | 7.8 | 2024-11-14 | A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existin… |
CVE-2024-10082 | High | 8.7 | 2024-11-06 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication method confusion allows… |
CVE-2024-50478 | Critical | 9.8 | 2024-10-28 | Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-C… |
CVE-2024-9683 | Medium | 4.8 | 2024-10-17 | A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authenticat… |
CVE-2024-20463 | Medium | 5.4 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker… |
CVE-2024-8642 | High | 8.1 | 2024-09-11 | In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token val… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-7557 | High | 8.8 | 2024-08-12 | A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deployin… |
CVE-2024-4784 | Medium | 4.2 | 2024-08-08 | An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the pas… |
CVE-2024-6637 | High | 7.3 | 2024-07-20 | The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is… |
CVE-2024-38433 | Medium | 6.7 | 2024-07-11 | Nuvoton - CWE-305: Authentication Bypass by Primary Weakness
An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton… |
CVE-2024-39899 | Medium | 5.3 | 2024-07-09 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was… |
CVE-2023-41920 | Critical | 9.8 | 2024-07-02 | The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of… |
CVE-2024-37085 | Medium | 6.8 | 2024-06-25 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX… |
CVE-2023-4727 | High | 7.5 | 2024-06-11 | A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessi… |
CVE-2024-36388 | Critical | 10.0 | 2024-06-02 | MileSight DeviceHub -
CWE-305 Missing Authentication for Critical Function |
CVE-2024-34077 | High | 7.3 | 2024-05-14 | MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to… |