Export limit exceeded: 415317 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (728 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-3035 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 5.5 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks. | ||||
| CVE-2026-82269 | 1 Getgophish | 1 Gophish | 2026-08-28 | 8.1 High |
| Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required. | ||||
| CVE-2026-16639 | 1 Drupal | 1 Internationalization Single Sign-on | 2026-08-28 | 9.8 Critical |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-76943 | 1 Xiiaozet | 1 Xiiaozet Lk100w | 2026-08-28 | 9.8 Critical |
| Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise. | ||||
| CVE-2026-65641 | 1 Veeam | 1 One | 2026-08-27 | N/A |
| A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. | ||||
| CVE-2026-63587 | 1 Weidmueller | 1 Fwr Ie Sr 2tx Wl 4g Eu Us | 2026-08-27 | 8.6 High |
| The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability. | ||||
| CVE-2025-2080 | 2026-08-26 | N/A | ||
| Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products. | ||||
| CVE-2026-78259 | 2026-08-25 | 7.3 High | ||
| Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions. | ||||
| CVE-2026-73381 | 2 Supsysticcom, Wordpress | 2 Popup By Supsystic, Wordpress | 2026-08-24 | 9.1 Critical |
| Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | ||||
| CVE-2026-73379 | 2 Supsysticcom, Wordpress | 2 Contact Form By Supsystic, Wordpress | 2026-08-24 | 6.5 Medium |
| Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | ||||
| CVE-2021-43718 | 2026-08-21 | 5.3 Medium | ||
| An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP.. | ||||
| CVE-2026-73396 | 2 Makewebbetter, Wordpress | 2 Hubspot For Woocommerce, Wordpress | 2026-08-21 | 7.1 High |
| Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. | ||||
| CVE-2026-74001 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration & Membership | 2026-08-21 | 9.8 Critical |
| Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. | ||||
| CVE-2026-73399 | 2 Flutterwave, Wordpress | 2 Flutterwave Woocommerce, Wordpress | 2026-08-21 | 6.5 Medium |
| Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. | ||||
| CVE-2026-71879 | 1 Gbif | 1 Integrated Publishing Toolkit | 2026-08-21 | N/A |
| Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass | ||||
| CVE-2026-66677 | 2 Vaultdweller, Wordpress | 2 Leyka, Wordpress | 2026-08-21 | 7.6 High |
| Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-22049 | 1 Netapp | 2 Ontap, Ontap 9 | 2026-08-20 | 8.8 High |
| ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA. | ||||
| CVE-2026-50191 | 1 Rargames | 1 4gaboards | 2026-08-19 | 8.8 High |
| 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8. | ||||
| CVE-2026-73398 | 2 Papaki, Wordpress | 2 Piraeus Bank Woocommerce Payment Gateway, Wordpress | 2026-08-18 | 6.5 Medium |
| Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions. | ||||
| CVE-2026-24185 | 1 Nvidia | 1 Nvos | 2026-08-18 | 7.1 High |
| NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges. | ||||