OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 41
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.
Its weaknesses: 36
CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393
- 7.7CVE-2026-79637EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 7.4CVE-2026-78492EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 7.5CVE-2026-78490EPSS 0.5%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote acc…
- 5.9CVE-2026-78489EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 5.3CVE-2026-80174EPSS 0.3%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploi…
- 4.3CVE-2026-11838EPSS 0.3%
Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects…
- 7.3CVE-2026-80122EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 8.8CVE-2026-80099ExploitEPSS 2.9%
Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` fil…
- 6.4CVE-2026-79974EPSS 0.3%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this v…
- 5.6CVE-2026-79967EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 7.4CVE-2026-78494EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 8.2CVE-2026-78491EPSS 0.3%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially expl…
- 7.0CVE-2026-79636EPSS 0.2%
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access …
- 8.1CVE-2026-76009EPSS 0.9%
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-…
- 6.2CVE-2026-87733EPSS 0.2%
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures c…
- 7.5CVE-2026-87608EPSS 0.3%
Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
- 5.4CVE-2026-87571EPSS 0.2%
Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
- 4.3CVE-2026-87563EPSS 0.2%
Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- 4.3CVE-2026-87551EPSS 0.2%
Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
- 8.7CVE-2026-55250EPSS 0.9%
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-perfor…
- 6.0CVE-2026-86084EPSS 0.5%
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise…
- 6.7CVE-2026-85981EPSS 0.2%
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access…
- 5.5CVE-2026-78629EPSS 0.1%
The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptograph…
- 6.9CVE-2026-86810EPSS 0.8%
A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in impro…
- 5.5CVE-2026-86808EPSS 0.8%
A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. Th…
- 9.9CVE-2026-86464EPSS 0.5%
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. …
- 9.2CVE-2026-84197EPSS 0.3%
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the …
- 6.5CVE-2026-78560EPSS 0.3%
The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without …
- 2.1CVE-2026-86674EPSS 0.4%
A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function session_start of the file login.php. The manipulation results in session fixia…
- 7.8CVE-2026-49887EPSS 0.09%
In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
- 9.8CVE-2026-28606EPSS 0.4%
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges need…
- 5.5CVE-2026-86673EPSS 0.5%
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connecti…
- 5.5CVE-2026-86669EPSS 0.7%
A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible…
- 7.4CVE-2026-84003EPSS 0.6%
Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
- 5.5CVE-2026-83991EPSS 0.3%
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.
- 8.6CVE-2026-80097EPSS 0.5%
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
- 8.8CVE-2026-77483EPSS 0.8%
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.4CVE-2026-76196EPSS 0.2%
Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attac…
- 9.8CVE-2026-73025EPSS 0.9%
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
- 5.5CVE-2026-73004EPSS 0.3%
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.
- 5.5CVE-2026-72964EPSS 0.3%
Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally.
- 8.1CVE-2026-69854EPSS 0.7%
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
- 8.1CVE-2026-69680EPSS 0.3%
Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network.
- 8.8CVE-2026-69676EPSS 0.8%
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.
- 5.5CVE-2026-69674EPSS 0.3%
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally.
- 6.3CVE-2026-69559EPSS 0.3%
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- 5.5CVE-2026-69554EPSS 0.3%
Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
- 7.8CVE-2026-69528EPSS 0.3%
Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.
- 6.8CVE-2026-69415EPSS 0.7%
Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network.
- 5.5CVE-2026-69321EPSS 0.3%
Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.