CVE-2026-73337

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-9192

Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software Corporation

Products

Marklogic Server Marklogic Server

CVE-2026-82329

Potential authentication bypass leading to administrative access in Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

CVSS 3.1 · 9.8 Critical EPSS 14.4% KEV · Listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-49869

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

CVSS 3.1 · 10 Critical EPSS 2.1% KEV · Listed

Vendors

Kestra Kestra-io

Products

Kestra Kestra

CVE-2026-59822

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2026-68760

Potential remember-me authentication bypass in JFrog Artifactory

An unauthenticated user may bypass authentication under specific cache conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-84840

tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tsi-coop

Products

Tsi-dpdp-cms

CVE-2026-54600

Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ellite

Products

Wallos

CVE-2026-19806

Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Devitemsllc Wordpress

Products

Support Genix – Helpdesk, Ai Chatbot, Knowledge Base & Customer Support Ticketing System Wordpress

CVE-2026-73726

Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access

A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2026-76657

Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2026-76658

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2024-7956

Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Rockwell Automation

Products

Datamosaix Private Cloud

CVE-2026-12526

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-82906

sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sdcb

Products

Chats

CVE-2026-77194

Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding

The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpinsider-1

Products

Wordpress Simple Membership

CVE-2026-84114

Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication

A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cleo

Products

Harmony

CVE-2026-79938

Improper Authentication Allows Unauthorized Access in Dell PowerProtect Cyber Recovery

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Cyber Recovery Powerprotect Cyber Recovery

CVE-2026-61641

Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ellite

Products

Wallos

CVE-2026-40205

dovecot: Dovecot: Authorization bypass via partially valid OAuth2 token

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly requires all of them. The configured authorization policy is not enforced, so a token that was granted only part of the required permissions is accepted where it should have been rejected. Use local token validation where tokens can be validated locally. Update to non-vulnerable version. No publicly available exploits are known.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Open-xchange

Products

Ox Dovecot Ce Ox Dovecot Pro