cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 65

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 8.4CVE-2026-12504EPSS 0.2%

    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password …

  2. 7.4CVE-2026-15243EPSS 0.3%

    Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) c…

  3. 9.1CVE-2026-12877EPSS 0.4%

    The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This…

  4. 4.8CVE-2026-66139EPSS 0.5%

    OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.

  5. 6.5CVE-2026-11922EPSS 0.2%

    A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requ…

  6. 9.8CVE-2026-62825EPSS 0.9%

    Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

  7. 10.0CVE-2026-56191EPSS 0.9%

    Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

  8. 9.8CVE-2026-15981EPSS 1.3%

    The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the r…

  9. 9.8CVE-2026-15967EPSS 0.4%

    Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

  10. 9.8CVE-2026-10697EPSS 0.6%

    Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

  11. 8.8CVE-2026-63765EPSS 0.7%

    Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing auth…

  12. 5.3CVE-2026-47769EPSS 0.5%

    APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts arbitra…

  13. 9.1CVE-2026-15616EPSS 0.5%

    Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

  14. 7.5CVE-2026-15614EPSS 0.3%

    Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

  15. 9.1CVE-2026-15611EPSS 0.5%

    Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

  16. 10.0CVE-2026-64812EPSS 0.5%

    In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

  17. 7.5CVE-2026-59554EPSS 0.4%

    Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

  18. 8.1CVE-2026-59545EPSS 0.5%

    Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

  19. 6.5CVE-2026-59524EPSS 0.4%

    Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

  20. 8.8CVE-2026-16745EPSS 0.5%

    A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitra…

  21. 6.5CVE-2026-64875EPSS 0.4%

    Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.

  22. 6.3CVE-2026-15348EPSS 0.6%

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked t…

  23. 7.5CVE-2026-52688EPSS 0.2%

    RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation

  24. 7.5CVE-2026-14291EPSS 0.5%

    The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete auth…

  25. 8.8CVE-2026-61246EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  26. 8.8CVE-2026-60439EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  27. 8.8CVE-2026-60373EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  28. 9.8CVE-2026-60372EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  29. 9.8CVE-2026-60367EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  30. 10.0CVE-2026-60366EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  31. 7.5CVE-2026-64797EPSS 0.3%

    Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and pot…

  32. 7.5CVE-2026-63683EPSS 0.4%

    Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.

  33. 9.1CVE-2026-64829EPSS 0.5%

    Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear …

  34. 8.7CVE-2026-22049EPSS 0.5%

    ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials…

  35. 6.3CVE-2026-65012EPSS 0.4%

    InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerat…

  36. 8.6CVE-2026-13321EPSS 0.2%

    The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1…

  37. 9.1CVE-2026-62144EPSS 1.0%

    An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation m…

  38. 3.7CVE-2026-54478EPSS 0.2%

    In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXY…

  39. 9.3CVE-2026-16232KEVExploitEPSS 3.5%

    An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful …

  40. 6.3CVE-2026-65014EPSS 0.6%

    n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to …

  41. 9.1CVE-2026-56820EPSS 0.3%

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response …

  42. 8.7CVE-2026-65319EPSS 0.5%

    Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the autho…

  43. 8.1CVE-2026-62547EPSS 0.4%

    Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker…

  44. 8.8CVE-2026-62534EPSS 0.4%

    Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

  45. 5.3CVE-2026-62517EPSS 0.2%

    Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…

  46. 8.8CVE-2026-62498EPSS 0.4%

    Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker w…

  47. 8.8CVE-2026-62496EPSS 0.4%

    Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with…

  48. 7.5CVE-2026-62493EPSS 0.3%

    Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

  49. 5.0CVE-2026-62486EPSS 0.2%

    Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…

  50. 8.8CVE-2026-62478EPSS 0.4%

    Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged atta…