Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,621

Export CSV
CVE-2012-5886

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

CVSS 2.0 · 5.0 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2026-108157

Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Smp46
Products
Pingvin-share-x
CVE-2026-16823

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-83447

Unauthorized Data Access via Low Privilege HTTP Exploitation in Oracle Bills of Material

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Bills Of Material
CVE-2026-94270

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Deema Payment Gateway
CVE-2026-94271

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Deema Payment Gateway
CVE-2026-76743

Authentication Bypass Vulnerability in the Management Interface of AOS-S

A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe)
Products
Aos-switch
CVE-2026-103646

Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ultimate Multisite
CVE-2026-59358

UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret. UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret. Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Uaa
CVE-2026-107228

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contributes any cookie for the origin. In a shared client, stored cookies originating from one user can replace a different user's request cookie, causing the request to execute under the wrong session. This bypasses the earlier CVE-2024-53990 remediation, which covered cookies supplied through addCookie but not a directly supplied header. This issue is fixed in version 3.0.14.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Asynchttpclient Project
Products
Async-http-client
CVE-2021-30640

Auth weakness in JNDIRealm

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

CVSS 3.1 · 6.5 Medium EPSS 9.9% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Tomcat Debian Linux Communications Cloud Native Core Policy and 7 more
CVE-2026-105832

EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-18922

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Directory Server Directory Server E4s Enterprise Linux and 8 more
CVE-2026-102128

Kiteworks Email Protection Gateway Improper Authentication

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Accellion Kiteworks
Products
Kiteworks Kiteworks Email Protection Gateway
CVE-2026-102106

Kiteworks Email Protection Gateway improper authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Accellion Kiteworks
Products
Kiteworks Kiteworks Email Protection Gateway
CVE-2026-76752

Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access

Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe)
Products
Clearpass Policy Manager (cppm)
CVE-2026-76751

Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution

A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe)
Products
Clearpass Policy Manager (cppm)
CVE-2026-79796

Authentication Bypass Vulnerabilities in ClearPass Policy Manager

Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe)
Products
Clearpass Policy Manager (cppm)
CVE-2026-95676

AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Authentication Gateway Authpoint Authentication Gateway