cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 10

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 5.3CVE-2026-103302EPSS 0.3%

    The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated …

  2. 9.3CVE-2026-114119EPSS 0.4%

    Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network acces…

  3. 9.3CVE-2026-114108EPSS 0.5%

    HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can p…

  4. 8.3CVE-2026-114092EPSS 0.6%

    Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a…

  5. 7.6CVE-2026-114090EPSS 0.2%

    Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pag…

  6. 8.3CVE-2026-114088EPSS 0.4%

    Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_…

  7. 6.9CVE-2026-114086EPSS 0.4%

    Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:…

  8. 8.8CVE-2026-114085EPSS 0.2%

    Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network acce…

  9. 7.6CVE-2026-114047EPSS 0.2%

    FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept th…

  10. 8.9CVE-2026-113736EPSS 0.9%

    A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads t…

  11. 6.8CVE-2026-111943EPSS 0.4%

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a deny…

  12. 2.9CVE-2026-113735EPSS 0.7%

    A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be…

  13. 6.5CVE-2026-93744EPSS 0.4%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to aut…

  14. 9.8CVE-2026-91665EPSS 0.5%

    Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Succ…

  15. 8.2CVE-2026-91625EPSS 0.3%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows u…

  16. 9.1CVE-2026-91624EPSS 0.2%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows u…

  17. 8.2CVE-2026-91573EPSS 0.3%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows u…

  18. 8.1CVE-2026-91546EPSS 0.3%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated …

  19. 8.8CVE-2026-91535EPSS 0.3%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability all…

  20. 8.6CVE-2026-91534EPSS 0.2%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulne…

  21. 8.8CVE-2026-91532EPSS 0.4%

    Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker…

  22. 8.8CVE-2026-91521EPSS 0.3%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows l…

  23. 7.5CVE-2026-91515EPSS 0.2%

    Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows…

  24. 8.1CVE-2026-91506EPSS 0.3%

    Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…

  25. 7.3CVE-2026-91502EPSS 0.3%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauth…

  26. 9.8CVE-2026-91495EPSS 0.5%

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated at…

  27. 7.5CVE-2026-91493EPSS 0.3%

    Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentic…

  28. 9.8CVE-2026-91491EPSS 0.4%

    Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentic…

  29. 9.1CVE-2026-91490EPSS 0.4%

    Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentic…

  30. 5.3CVE-2026-91476EPSS 0.3%

    Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker …

  31. 6.6CVE-2026-91467EPSS 0.2%

    Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows physical access…

  32. 3.7CVE-2026-91461EPSS 0.2%

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, …

  33. 7.4CVE-2026-91450EPSS 0.3%

    Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with networ…

  34. 7.4CVE-2026-91449EPSS 0.2%

    Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with networ…

  35. 8.2CVE-2026-91445EPSS 0.2%

    Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with n…

  36. 8.8CVE-2026-91442EPSS 0.3%

    Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network a…

  37. 7.2CVE-2026-91433EPSS 0.4%

    Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network acc…

  38. 6.5CVE-2026-91430EPSS 0.2%

    Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker wit…

  39. 9.8CVE-2026-91408EPSS 0.4%

    Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentica…

  40. 8.8CVE-2026-91407EPSS 0.4%

    Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged at…

  41. 3.7CVE-2026-91392EPSS 0.2%

    Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTT…

  42. 8.2CVE-2026-91358EPSS 0.3%

    Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management Service (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulner…

  43. 9.8CVE-2026-91323EPSS 0.5%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauth…

  44. 8.1CVE-2026-91313EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated atta…

  45. 8.8CVE-2026-91310EPSS 0.3%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker wit…

  46. 9.1CVE-2026-91305EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attack…

  47. 8.8CVE-2026-91295EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged…

  48. 5.9CVE-2026-91282EPSS 0.3%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Portal SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with n…

  49. 6.5CVE-2026-91274EPSS 0.3%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthentic…

  50. 8.8CVE-2026-91270EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privilege…