Total
729 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-61425 | 2026-10-24 | N/A | N/A | ||
| Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. | |||||
| CVE-2026-16198 | 2026-10-24 | 5.1 MEDIUM | 5.6 MEDIUM | ||
| A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue. | |||||
| CVE-2026-43945 | 2026-10-24 | N/A | N/A | ||
| FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue. | |||||
| CVE-2026-66465 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |||||
| CVE-2026-66425 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions. | |||||
| CVE-2026-66451 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | |||||
| CVE-2026-65542 | 2026-10-24 | N/A | 8.8 HIGH | ||
| Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |||||
| CVE-2026-24254 | 2 Linux, Nvidia | 2 Linux Kernel, Dynamo | 2026-10-24 | N/A | 9.8 CRITICAL |
| NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | |||||
| CVE-2026-58073 | 2026-10-24 | N/A | N/A | ||
| A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | |||||
| CVE-2026-74001 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. | |||||
| CVE-2026-70468 | 1 Fortinet | 2 Fortimanager, Fortimanager Cloud | 2026-10-24 | N/A | 8.1 HIGH |
| A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via <insert attack vector here> | |||||
| CVE-2026-72691 | 2026-10-24 | N/A | 7.5 HIGH | ||
| An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId. | |||||
| CVE-2026-22049 | 1 Netapp | 1 Ontap | 2026-10-24 | N/A | 8.8 HIGH |
| ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA. | |||||
| CVE-2026-59545 | 2026-10-24 | N/A | 8.1 HIGH | ||
| Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | |||||
| CVE-2026-59524 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. | |||||
| CVE-2026-8338 | 2026-10-24 | N/A | N/A | ||
| A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity. | |||||
| CVE-2026-42629 | 2026-10-23 | N/A | 8.8 HIGH | ||
| Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. | |||||
| CVE-2026-18556 | 1 N-able | 1 N-central | 2026-10-23 | N/A | 7.4 HIGH |
| Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. | |||||
| CVE-2026-33591 | 2026-10-23 | N/A | N/A | ||
| A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account. | |||||
| CVE-2026-73379 | 2026-10-23 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | |||||