Total
729 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-91143 | 2026-09-23 | N/A | 7.2 HIGH | ||
| goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations. | |||||
| CVE-2026-82269 | 2026-09-23 | N/A | 8.1 HIGH | ||
| Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required. | |||||
| CVE-2026-93928 | 2026-09-22 | N/A | 7.3 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8. | |||||
| CVE-2026-81796 | 2026-09-21 | N/A | 7.3 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3. | |||||
| CVE-2026-88260 | 2026-09-18 | N/A | N/A | ||
| Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM (Build 109). | |||||
| CVE-2026-14917 | 2026-09-18 | N/A | N/A | ||
| A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature. As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators | |||||
| CVE-2026-62101 | 2026-09-17 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. | |||||
| CVE-2026-27546 | 2026-09-16 | N/A | 9.8 CRITICAL | ||
| An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured. | |||||
| CVE-2026-20079 | 1 Cisco | 1 Secure Firewall Management Center | 2026-09-16 | N/A | 10.0 CRITICAL |
| A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. | |||||
| CVE-2026-76169 | 1 Fastify | 1 Fastify | 2026-09-15 | N/A | 7.5 HIGH |
| fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later. | |||||
| CVE-2026-75045 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 9.1 CRITICAL |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature | |||||
| CVE-2026-57134 | 2026-09-15 | N/A | 8.2 HIGH | ||
| PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2. | |||||
| CVE-2026-81906 | 2026-09-11 | N/A | N/A | ||
| Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully authenticated for the callback response, with the login recorded and login events dispatched. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | |||||
| CVE-2026-86084 | 1 N8n | 1 N8n | 2026-09-10 | N/A | 5.5 MEDIUM |
| n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. | |||||
| CVE-2026-81787 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. | |||||
| CVE-2026-81783 | 2026-09-10 | N/A | 7.1 HIGH | ||
| Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. | |||||
| CVE-2026-81168 | 1 Captcha Protected Page Project | 1 Captcha Protected Page | 2026-09-09 | N/A | 3.7 LOW |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2. | |||||
| CVE-2021-43718 | 2026-09-09 | N/A | 5.3 MEDIUM | ||
| An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP.. | |||||
| CVE-2026-77103 | 3 Commvault, Linux, Microsoft | 3 Commvault, Linux Kernel, Windows | 2026-09-09 | N/A | 7.5 HIGH |
| CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe. | |||||
| CVE-2026-65641 | 2026-09-09 | N/A | N/A | ||
| A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. | |||||