CWE-287

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive app

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalys

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0,

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Versions 0.30.0-rc6

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 202

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (S

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57,

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a net

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Co

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestr

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform

: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions)

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_ur

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering t

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitation

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported

Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectiv

wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, an authentication bypass vul

The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated rem

A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-fa

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vuln

Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not requi

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not requi

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote a

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.p

A remote authentication bypass vulnerability  exists in HPE AutoPass License Server (APLS).

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and ear

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.8.6, 7.9.8, 7.10.

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to versions 7.10.8, 7.11.5, 7.1

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allo

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote atta

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the com

MinIO is a high-performance object storage system. From RELEASE.2022-11-08T05-27-07Z to before RELEASE.2026-03-17T21-25-