cve.bz

OWASP A07:2025 Authentication Failures vulnerabilities, newest first, page 74

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A07:2025 at MITRE.

Its weaknesses: 36

CWE-258, CWE-259, CWE-287, CWE-288, CWE-289, CWE-290, CWE-291, CWE-293, CWE-294, CWE-295, CWE-297, CWE-298, CWE-299, CWE-300, CWE-302, CWE-303, CWE-304, CWE-305, CWE-306, CWE-307, CWE-308, CWE-309, CWE-346, CWE-350, CWE-384, CWE-521, CWE-613, CWE-620, CWE-640, CWE-798, CWE-940, CWE-941, CWE-1390, CWE-1391, CWE-1392, CWE-1393

  1. 9.1CVE-2026-45363EPSS 0.4%

    ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload…

  2. 2.7CVE-2026-48329EPSS 0.6%

    ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write…

  3. 9.3CVE-2026-48325EPSS 0.6%

    ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is…

  4. 6.4CVE-2026-24259EPSS 0.2%

    NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information d…

  5. 7.3CVE-2026-24229EPSS 0.2%

    NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of th…

  6. 6.5CVE-2026-15775EPSS 0.2%

    Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

  7. 6.5CVE-2026-15768EPSS 0.2%

    Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

  8. 8.2CVE-2026-50528EPSS 0.6%

    Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

  9. 8.6CVE-2026-48252EPSS 0.9%

    Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unautho…

  10. 7.5CVE-2026-47737EPSS 0.2%

    Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorr…

  11. 6.5CVE-2026-47481EPSS 0.4%

    NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalat…

  12. 6.9CVE-2026-47212EPSS 1.5%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature…

  13. 8.8CVE-2026-47303EPSS 0.8%

    Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

  14. 8.8CVE-2026-47300EPSS 0.8%

    Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

  15. 6.9CVE-2026-45755EPSS 0.3%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC heade…

  16. 6.9CVE-2026-45754EPSS 0.4%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets …

  17. 9.1CVE-2026-45063EPSS 0.4%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchor…

  18. 8.3CVE-2026-56181EPSS 0.3%

    Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

  19. 9.1CVE-2026-55040KEVExploitEPSS 70%

    Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

  20. 7.8CVE-2026-50451EPSS 0.3%

    Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

  21. 8.8CVE-2026-50444EPSS 0.8%

    Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network.

  22. 8.0CVE-2026-50365EPSS 0.5%

    Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

  23. 8.8CVE-2026-50360EPSS 0.8%

    Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  24. 6.5CVE-2026-50302EPSS 0.3%

    Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.

  25. 7.6CVE-2026-45074EPSS 0.5%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an atta…

  26. 8.8CVE-2026-57969EPSS 0.8%

    Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

  27. 7.8CVE-2026-57107EPSS 0.3%

    Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.

  28. 6.5CVE-2026-56185EPSS 0.8%

    Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.

  29. 8.8CVE-2026-56169EPSS 0.7%

    Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

  30. 9.8CVE-2026-56164KEVEPSS 1.0%

    Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

  31. 7.8CVE-2026-55001EPSS 0.3%

    Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.

  32. 8.2CVE-2026-50338EPSS 0.5%

    Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

  33. 7.8CVE-2026-50333EPSS 0.3%

    Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

  34. 6.1CVE-2026-49174EPSS 0.3%

    Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

  35. 8.8CVE-2026-47632EPSS 0.5%

    Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

  36. 8.2CVE-2026-9636EPSS 0.2%

    A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certifica…

  37. 9.8CVE-2026-62644EPSS 0.3%

    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

  38. 9.8CVE-2026-59836EPSS 0.2%

    A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via <insert attack vector here>

  39. 9.1CVE-2026-55954EPSS 0.5%

    Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id_toke…

  40. 8.8CVE-2026-10714EPSS 0.1%

    A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm…

  41. 10.0CVE-2026-10577EPSS 0.4%

    A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-li…

  42. 9.8CVE-2026-62422EPSS 0.6%

    In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

  43. 9.1CVE-2026-58319EPSS 0.7%

    Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially a…

  44. 8.9CVE-2026-15416EPSS 0.5%

    A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, t…

  45. 8.2CVE-2026-15076EPSS 0.2%

    In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating ser…

  46. 8.2CVE-2026-15075EPSS 0.2%

    In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no…

  47. 9.1CVE-2026-44761EPSS 0.5%

    SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use th…

  48. 9.3CVE-2026-62327EPSS 6.3%

    9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request …

  49. 8.7CVE-2026-61458EPSS 0.4%

    PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passph…

  50. 9.3CVE-2026-59801ExploitEPSS 2.6%

    9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middl…