Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Tag: auth-bypass Clear

ID	Title	Severity	Tags	Detected
CVE-2026-8153	OS Command Injection in iot-embedded (CVE-2026-8153) OS command injection in iot-embedded (CVE-2026-8153). Successful exploitation can lead to full system takeover.	Critical	Cwe 78 Os Network Iot Embedded +8	3 months ago
CVE-2013-10075	Vulnerability in apache (CVE-2013-10075) vulnerability in apache (CVE-2013-10075). Confidential information can be exposed externally.	Critical	Apache Cwe 672 Chorny Perl +12	3 months ago
CVE-2025-69690	Unsafe Deserialization in deserialization (CVE-2025-69690) vulnerability in deserialization (CVE-2025-69690). Successful exploitation can lead to full system takeover.	Critical	PHP Cwe 502 Cwe 915 Remote Code Execution +13	3 months ago
CVE-2023-46453	SQL Injection in network-device (CVE-2023-46453) SQL injection in network-device (CVE-2023-46453). Successful exploitation can lead to full system takeover.	Critical	Authentication Bypass Cwe 89 Sql Injection Network Device +11	3 months ago
CVE-2024-51092	OS Command Injection in command-injection (CVE-2024-51092) OS command injection in command-injection (CVE-2024-51092). Confidential information can be exposed externally. Exploitable via ``version_netsnmp``.	Critical	PHP Cwe 78 Authentication Bypass Command Injection +12	3 months ago
CVE-2026-41500	Command Injection in electerm-project (CVE-2026-41500) command injection in electerm-project (CVE-2026-41500). Successful exploitation can lead to full system takeover. Exploitable via ``releaseInfo.name``. Mitigation: upgrade to `> 3.2.0` or later.	Critical	JavaScript Cwe 77 Electerm Project Electerm +10	3 months ago
CVE-2026-41501	Command Injection in electerm (CVE-2026-41501) command injection in electerm (CVE-2026-41501). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `> 3.2.0` or later.	Critical	JavaScript Cwe 77 Electerm Project Electerm +11	3 months ago
CVE-2026-6736	Vulnerability in github (CVE-2026-6736) vulnerability in github (CVE-2026-6736). Risk of unauthorized operations or information disclosure.	Medium	Authentication Bypass Cwe 306 Github Enterprise Server	3 months ago
CVE-2026-33823	Vulnerability in microsoft (CVE-2026-33823) vulnerability in microsoft (CVE-2026-33823). Confidential information can be exposed externally.	Critical	Cwe 285 Microsoft Teams Authentication Bypass +11	3 months ago
CVE-2026-41902	Vulnerability in laravel (CVE-2026-41902) vulnerability in laravel (CVE-2026-41902). Confidential information can be exposed externally. Exploitable via `Referer header`.	Critical	PHP Laravel Cwe 613 Authentication Bypass +8	3 months ago
CVE-2025-63704	Vulnerability in prototype-pollution (CVE-2025-63704) vulnerability in prototype-pollution (CVE-2025-63704). Successful exploitation can lead to full system takeover.	Critical	Cwe 1321 Prototype Pollution npm JavaScript +11	3 months ago
CVE-2026-42010	Vulnerability in gnu (CVE-2026-42010) vulnerability in gnu (CVE-2026-42010). Confidential information can be exposed externally.	High	Authentication Bypass Cwe 626 Gnu Gnutls +5	3 months ago
CVE-2026-43198	Vulnerability in linux (CVE-2026-43198) vulnerability in linux (CVE-2026-43198). Successful exploitation can lead to full system takeover.	Critical	Linux Tcp Race Condition Cve 2026 43198 +11	3 months ago
CVE-2026-43117	Vulnerability in linux (CVE-2026-43117) vulnerability in linux (CVE-2026-43117). Confidential information can be exposed externally.	Critical	Linux Linux Kernel Os Privilege Escalation +11	3 months ago
CVE-2026-35579	Authentication Bypass in github.com/coredns/coredns (CVE-2026-35579) authentication bypass in github.com/coredns/coredns (CVE-2026-35579). Successful exploitation can lead to full system takeover. Exploitable via ``tsigStatus``. Mitigation: upgrade to `1.14.3` or later.	Critical	Cwe 287 Corednsio Coredns Go +20	3 months ago
CVE-2026-33190	Authentication Bypass in github.com/coredns/coredns (CVE-2026-33190) authentication bypass in github.com/coredns/coredns (CVE-2026-33190). Confidential information can be exposed externally. Mitigation: upgrade to `1.14.3` or later.	High	Cwe 303 Corednsio Coredns Go +3	3 months ago
CVE-2026-38431	Code Injection in frappe (CVE-2026-38431) code injection in frappe (CVE-2026-38431). Successful exploitation can lead to full system takeover.	Critical	Cwe 94 Frappe Erpnext Server-Side Template Injection +15	3 months ago
CVE-2026-42087	SQL Injection in sqli (CVE-2026-42087) SQL injection in sqli (CVE-2026-42087). Confidential information can be exposed externally. Exploitable via ``tsdb_lookup``.	Critical	SQL Injection Cwe 89 Openc3 Cosmos +11	3 months ago
CVE-2026-32834	Vulnerability in wordpress (CVE-2026-32834) vulnerability in wordpress (CVE-2026-32834). Confidential information can be exposed externally.	High	WordPress Authentication Bypass Cwe 798	3 months ago
CVE-2026-31773	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy responder path in smp_random() currently lab... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects wh...	High	Linux Linux Kernel Bluetooth Cwe 254 +1	3 months ago
CVE-2026-31431 KEV	[KEV] Vulnerability in Linux redhat (CVE-2026-31431) vulnerability in Linux redhat (CVE-2026-31431). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	High	Cwe 669 Linux Linux Kernel Redhat +76	3 months ago
CVE-2026-35051	Vulnerability in github.com/traefik/traefik (CVE-2026-35051) vulnerability in github.com/traefik/traefik (CVE-2026-35051). Confidential information can be exposed externally. Exploitable via ``ForwardAuth``. Mitigation: upgrade to `2.11.43` or later.	Critical	Authentication Bypass Cwe 345 Cwe 501 Traefik	3 months ago
CVE-2026-39858	Vulnerability in github.com/traefik/traefik (CVE-2026-39858) vulnerability in github.com/traefik/traefik (CVE-2026-39858). Confidential information can be exposed externally. Exploitable via `GET /protected`. Mitigation: upgrade to `2.11.43` or later.	Critical	Authentication Bypass Cwe 290 Cwe 306 Cwe 289 +1	3 months ago
CVE-2026-40912	Path Traversal in github.com/traefik/traefik/v3 (CVE-2026-40912) path traversal in github.com/traefik/traefik/v3 (CVE-2026-40912). Confidential information can be exposed externally. Mitigation: upgrade to `3.6.14, 3.7.0-rc.2` or later.	High	Authentication Bypass Cwe 706 Cwe 22 Traefik	3 months ago
CVE-2026-41940 KEV	[KEV] Vulnerability in Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940) vulnerability in Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Webpros Cpanel Whm And Wp2 Wordpress Squared Cwe 306 WordPress +6	4 months ago
CVE-2026-5140	Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM... Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM...	High	Authentication Bypass Cwe 93 Pardus Os	4 months ago
CVE-2026-38651	Vulnerability in github.com/gravitl/netmaker (CVE-2026-38651) vulnerability in github.com/gravitl/netmaker (CVE-2026-38651). Confidential information can be exposed externally. Exploitable via ``VerifyHostToken``. Mitigation: upgrade to `1.5.0` or later.	High	Authentication Bypass Cwe 347 Netmaker	4 months ago
CVE-2026-41473	Vulnerability in dos (CVE-2026-41473) vulnerability in dos (CVE-2026-41473). Data can be tampered with by attackers.	Critical	Authentication Bypass Denial of Service Cwe 306 Cyberpanel	4 months ago
CVE-2024-57726 KEV	[KEV] Vulnerability in Simplehelp auth (CVE-2024-57726) vulnerability in Simplehelp auth (CVE-2024-57726). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Simplehelp Cwe 862 Remote Code Execution Authentication Bypass +10	4 months ago
CVE-2026-6886	Vulnerability in CVE-2026-6886 (CVE-2026-6886) vulnerability in CVE-2026-6886 (CVE-2026-6886). Successful exploitation can lead to full system takeover.	Critical	Authentication Bypass Cwe 1390	4 months ago
CVE-2026-34415	Vulnerability in path-traversal (CVE-2026-34415) vulnerability in path-traversal (CVE-2026-34415). Successful exploitation can lead to full system takeover.	Critical	PHP Path Traversal Authentication Bypass Cwe 184	4 months ago
CVE-2025-2749 KEV	[KEV] Path Traversal in Kentico path-traversal (CVE-2025-2749) path traversal in Kentico path-traversal (CVE-2025-2749). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Kentico Kentico Xperience Cwe 22 Cwe 434 +10	4 months ago
CVE-2023-27351 KEV	[KEV] Authentication Bypass in Papercut ngmf (CVE-2023-27351) authentication bypass in Papercut ngmf (CVE-2023-27351). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Papercut Ngmf Cwe 287 Authentication Bypass +11	4 months ago
CVE-2026-20128 KEV	[KEV] Vulnerability in Cisco catalyst-sd-wan-manager (CVE-2026-20128) vulnerability in Cisco catalyst-sd-wan-manager (CVE-2026-20128). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Cisco Catalyst Sd Wan Manager Cwe 257 Authentication Bypass	4 months ago
CVE-2025-32975 KEV	[KEV] Authentication Bypass in Quest kace-systems-management-appliance-sma (CVE-2025-32975) authentication bypass in Quest kace-systems-management-appliance-sma (CVE-2025-32975). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Quest Kace Systems Management Appliance Sma Cwe 287 Authentication Bypass	4 months ago
CVE-2026-40525	Vulnerability in openviking (CVE-2026-40525) vulnerability in openviking (CVE-2026-40525). Confidential information can be exposed externally. Exploitable via `X-API-Key header`. Mitigation: upgrade to `0.3.9` or later.	Critical	Authentication Bypass Cwe 636 Volcengine Openviking	4 months ago
CVE-2026-3324	Vulnerability in zohocorp (CVE-2026-3324) vulnerability in zohocorp (CVE-2026-3324). Confidential information can be exposed externally.	High	Authentication Bypass Cwe 288 Zohocorp Manageengine Log360	4 months ago
CVE-2026-34197 KEV	[KEV] Vulnerability in Apache activemq (CVE-2026-34197) vulnerability in Apache activemq (CVE-2026-34197). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Apache Activemq Cwe 20 Cwe 94 +11	4 months ago
CVE-2026-34457	Vulnerability in oauth2-proxy (CVE-2026-34457) vulnerability in oauth2-proxy (CVE-2026-34457). Confidential information can be exposed externally. Mitigation: upgrade to `7.15.2` or later.	Critical	nginx Authentication Bypass Cwe 290 Oauth2 Proxy Project +1	4 months ago
CVE-2012-1854 KEV	[KEV] Vulnerability in Microsoft visual-basic-for-applications-vba (CVE-2012-1854) vulnerability in Microsoft visual-basic-for-applications-vba (CVE-2012-1854). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.	High	Microsoft Visual Basic For Applications Vba Cwe 426 Vba +7	4 months ago
CVE-2026-39976	Authentication Bypass in laravel (CVE-2026-39976) authentication bypass in laravel (CVE-2026-39976). Confidential information can be exposed externally. Mitigation: upgrade to `13.7.1` or later.	High	Laravel Authentication Bypass Cwe 287 Passport	4 months ago
CVE-2026-4326	The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate... The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check...	High	WordPress Cwe 862 PHP Authentication Bypass	4 months ago
CVE-2026-5557	Authentication Bypass in CVE-2026-5557 (CVE-2026-5557) authentication bypass in CVE-2026-5557 (CVE-2026-5557). Risk of unauthorized operations or information disclosure.	Medium	Authentication Bypass Cwe 287 Cwe 288	4 months ago
CVE-2026-3445	The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass i... The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the...	High	WordPress Cwe 862 PHP Authentication Bypass	4 months ago
CVE-2017-20234	Vulnerability in CVE-2017-20234 (CVE-2017-20234) vulnerability in CVE-2017-20234 (CVE-2017-20234). Successful exploitation can lead to full system takeover.	Critical	Authentication Bypass Cwe 798	4 months ago
CVE-2017-20235	Authentication Bypass in prosoft-technology (CVE-2017-20235) authentication bypass in prosoft-technology (CVE-2017-20235). Confidential information can be exposed externally.	Critical	Authentication Bypass Cwe 287 Prosoft Technology Icx35 Hwc Firmware +1	4 months ago
CVE-2018-25236	Authentication Bypass in CVE-2018-25236 (CVE-2018-25236) authentication bypass in CVE-2018-25236 (CVE-2018-25236). Successful exploitation can lead to full system takeover.	Critical	Authentication Bypass Cwe 287	4 months ago
CVE-2026-33175	Authentication Bypass in jupyter (CVE-2026-33175) authentication bypass in jupyter (CVE-2026-33175). Successful exploitation can lead to full system takeover.	High	Authentication Bypass Cwe 287 Cwe 290 Jupyter +1	4 months ago
CVE-2017-20237	Authentication Bypass in CVE-2017-20237 (CVE-2017-20237) authentication bypass in CVE-2017-20237 (CVE-2017-20237). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution Authentication Bypass Cwe 287	4 months ago
CVE-2026-0545	Vulnerability in mlflow (CVE-2026-0545) vulnerability in mlflow (CVE-2026-0545). Confidential information can be exposed externally.	Critical	Remote Code Execution Authentication Bypass Denial of Service Cwe 306 +2	4 months ago

Vulnerabilities

🍪 About cookies