cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 53

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 5.1CVE-2026-63336EPSS 0.3%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) co…

  2. 9.1CVE-2026-52723EPSS 0.4%

    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll…

  3. 7.5CVE-2026-50578EPSS 0.3%

    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in …

  4. 9.1CVE-2026-18963ExploitEPSS 4.7%

    A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password…

  5. 8.2CVE-2026-73337EPSS 0.5%

    Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

  6. 5.4CVE-2026-73995EPSS 0.4%

    Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

  7. 6.5CVE-2026-73399EPSS 0.4%

    Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

  8. 6.5CVE-2026-73398EPSS 0.4%

    Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

  9. 7.1CVE-2026-73396EPSS 0.4%

    Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

  10. 9.1CVE-2026-73381EPSS 0.5%

    Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

  11. 6.5CVE-2026-73379EPSS 0.3%

    Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

  12. 7.4CVE-2026-59825EPSS 0.4%

    Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP a…

  13. 7.5CVE-2026-32481EPSS 0.5%

    Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

  14. 7.7CVE-2026-50575EPSS 0.2%

    BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Vers…

  15. 8.1CVE-2026-74981EPSS 0.2%

    Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  16. 5.4CVE-2026-74974EPSS 0.2%

    Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  17. 5.4CVE-2026-74970EPSS 0.2%

    Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  18. 5.4CVE-2026-74968EPSS 0.2%

    Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  19. 5.4CVE-2026-74967EPSS 0.2%

    Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  20. 5.4CVE-2026-74963EPSS 0.2%

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  21. 8.1CVE-2026-74962EPSS 0.2%

    Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  22. 8.1CVE-2026-74960EPSS 0.2%

    Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  23. 7.5CVE-2026-74934EPSS 0.2%

    Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  24. 7.7CVE-2026-23933EPSS 0.6%

    In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest u…

  25. 9.3CVE-2026-75854EPSS 0.9%

    ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arb…

  26. 9.3CVE-2026-75852EPSS 0.7%

    ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connect…

  27. 2.9CVE-2026-75774EPSS 0.6%

    A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is p…

  28. 2.9CVE-2026-75773EPSS 0.7%

    A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excess…

  29. 9.3CVE-2026-75627EPSS 0.8%

    Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrati…

  30. 5.9CVE-2026-65329EPSS 0.2%

    An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to bypass IPSec authentication and in…

  31. 8.6CVE-2026-56677EPSS 0.4%

    9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js withou…

  32. 5.9CVE-2026-45791EPSS 0.4%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compro…

  33. 8.7CVE-2026-75479EPSS 0.5%

    JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to…

  34. 9.8CVE-2026-67966EPSS 0.6%

    Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access.

  35. 9.9CVE-2026-66795EPSS 0.5%

    A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. Th…

  36. 8.4CVE-2026-75060EPSS 0.2%

    In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

  37. 9.1CVE-2026-75045EPSS 0.5%

    In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

  38. 7.7CVE-2025-27621EPSS 0.5%

    UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API ke…

  39. 9.3CVE-2026-71566EPSS 0.4%

    FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and compl…

  40. 9.3CVE-2026-74894EPSS 0.7%

    openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys…

  41. 8.7CVE-2026-74893EPSS 0.4%

    openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to…

  42. 8.7CVE-2026-74892EPSS 0.5%

    openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to co…

  43. 8.7CVE-2026-74891EPSS 0.5%

    openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive…

  44. 8.7CVE-2026-74868EPSS 0.5%

    SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate,…

  45. 7.1CVE-2026-74802EPSS 0.2%

    SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers ca…

  46. 6.6CVE-2026-50601EPSS 0.4%

    A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administr…

  47. 9.3CVE-2026-19977EPSS 1.3%

    A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitatio…

  48. 2.9CVE-2026-19974EPSS 0.6%

    A security flaw has been discovered in treefrogframework treefrog-framework up to 2.11.2. This vulnerability affects the function std::strncmp of the file src/tsessioncookiestore.cpp of the component Session Cookie Handler. The manipulatio…

  49. 5.3CVE-2026-19971EPSS 0.4%

    A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the lo…

  50. 9.3CVE-2026-73056EPSS 0.8%

    SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/…