cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 17

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 8.7CVE-2026-104939EPSS 0.4%

    Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated acce…

  2. 9.8CVE-2026-16740EPSS 1.7%

    Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1…

  3. 7.3CVE-2026-107421EPSS 0.2%

    Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.

  4. 8.7CVE-2026-108071EPSS 0.5%

    Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the aut…

  5. 8.7CVE-2026-103905EPSS 0.5%

    The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can there…

  6. 4.7CVE-2026-109969EPSS 0.1%

    A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user ca…

  7. 7.4CVE-2026-100163EPSS 0.4%

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() he…

  8. 5.3CVE-2026-87974EPSS 0.3%

    The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to th…

  9. 7.0CVE-2026-107153EPSS 0.2%

    Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.

  10. 8.7CVE-2026-108473EPSS 0.3%

    Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or …

  11. 9.9CVE-2026-97381EPSS 0.2%

    Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the h…

  12. 7.6CVE-2026-84790EPSS 0.1%

    OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

  13. 5.9CVE-2026-103294EPSS 0.2%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  14. 7.5CVE-2026-100123EPSS 0.3%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  15. 7.5CVE-2026-100122EPSS 0.3%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  16. 7.5CVE-2026-100121EPSS 0.3%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  17. 7.5CVE-2026-100118EPSS 0.4%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  18. 5.9CVE-2026-100116EPSS 0.3%

    CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write a…

  19. 9.1CVE-2026-93909EPSS 0.3%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

  20. 6.5CVE-2026-77816EPSS 0.2%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.

  21. 5.4CVE-2026-107371EPSS 0.2%

    When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token tha…

  22. 8.6CVE-2026-63161EPSS 0.4%

    Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can explo…

  23. 9.1CVE-2026-63159EPSS 0.3%

    Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reu…

  24. 7.0CVE-2026-97793EPSS 0.2%

    Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.

  25. 5.5CVE-2026-96858EPSS 0.5%

    Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.

  26. 7.0CVE-2026-96313EPSS 0.2%

    Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  27. 6.5CVE-2026-96238EPSS 0.3%

    Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

  28. 5.3CVE-2026-96234EPSS 0.3%

    Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

  29. 7.4CVE-2026-96222EPSS 0.6%

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  30. 5.5CVE-2026-96183EPSS 0.4%

    Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.

  31. 5.9CVE-2026-88132EPSS 0.3%

    Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.

  32. 7.8CVE-2026-88101EPSS 0.2%

    Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

  33. 7.4CVE-2026-87705EPSS 0.4%

    Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.

  34. 5.3CVE-2026-85939EPSS 0.4%

    Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.

  35. 7.4CVE-2026-85922EPSS 0.6%

    Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

  36. 7.8CVE-2026-85884EPSS 0.4%

    Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.

  37. 5.5CVE-2026-85865EPSS 0.3%

    Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.

  38. 7.8CVE-2026-85376EPSS 0.3%

    Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

  39. 7.0CVE-2026-85328EPSS 0.2%

    Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  40. 6.8CVE-2026-85323EPSS 0.5%

    Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.

  41. 8.8CVE-2026-83928EPSS 0.6%

    Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.

  42. 4.4CVE-2026-83926EPSS 0.4%

    Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

  43. 6.5CVE-2026-83906EPSS 1.0%

    Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

  44. 5.5CVE-2026-83864EPSS 0.4%

    Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.

  45. 5.5CVE-2026-83854EPSS 0.3%

    Improper access control in Windows Notification allows an authorized attacker to disclose information locally.

  46. 8.4CVE-2026-83845EPSS 0.3%

    Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.

  47. 7.8CVE-2026-83840EPSS 0.4%

    Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

  48. 5.5CVE-2026-83787EPSS 0.3%

    Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.

  49. 7.1CVE-2026-83715EPSS 0.3%

    Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.

  50. 5.5CVE-2026-83681EPSS 0.3%

    Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.