tag

Auth-Bypass

PaperCut MF/NG Auth Bypass + RCE Chain (CVE-2026-81578 / CVE-2026-82078)

CVE-2026-81578, CVE-2026-82078 web Unverified

CVE-2026-81578, CVE-2026-82078webCRITICAL 9.8Unverified2026-09-05UniFi OS -- Unauthenticated Command Injection RCE (CVE-2026-34910) KEV EPSS 87%

CVE-2026-34910, CVE-2026-34909, CVE-2026-34908 network Patched

CVE-2026-34910, CVE-2026-34909, CVE-2026-34908networkCRITICAL 10Patched2026-08-16Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882) KEV RW EPSS 100%

CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025) web Patched

CVE-2025-61882webCRITICAL 9.8Patched2026-08-09Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)

CVE-2025-65856 hardware Unverified

CVE-2025-65856hardwareCRITICAL 9.8Unverified2026-07-06Twonky Server 8.5.2 Unauthenticated `/nmc/rpc/` Auth Bypass & Admin Credential Log Leak (CVE-2025-13315) EPSS 33%

CVE-2025-13315 network Unpatched

CVE-2025-13315networkCRITICAL 9.8Unpatched2026-07-06FlowiseAI Account-Takeover via Forgot-Password Token Leak (CVE-2025-58434) EPSS 50%

CVE-2025-58434 web Patched

CVE-2025-58434webCRITICAL 9.8Patched2026-07-06ZTE ZXHN H188A Unauthenticated Wizard Handler Credential Disclosure / Auth Bypass (CVE-2026-34472)

CVE-2026-34472 network Unverified

CVE-2026-34472networkCRITICALUnverified2026-07-05WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415

CVE-2026-5415 web Unverified

CVE-2026-5415webHIGH 8.8Unverified2026-07-05WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)

CVE-2026-12416, CVE-2026-12417 web Unverified

CVE-2026-12416, CVE-2026-12417webCRITICAL 9.8Unverified2026-07-05SmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001)

CVE-2026-0001 (tracked publicly as WT-2026-0001) web Patched

CVE-2026-0001webCRITICAL 9Patched2026-07-05SimpleHelp OIDC Authentication Bypass (CVE-2026-48558) KEV EPSS 12%

CVE-2026-48558 web Patched

CVE-2026-48558webCRITICAL 9.8Patched2026-07-05pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000

CVE-2026-29000 web Patched

CVE-2026-29000webCRITICAL 9.8Patched2026-07-05OpenClaw Gateway WebSocket Authentication Bypass RCE — CVE-2026-28466

CVE-2026-28466 network Patched

CVE-2026-28466networkCRITICALPatched2026-07-05NVIDIA Triton Inference Server SageMaker Auth Bypass to Unauthenticated RCE (CVE-2026-24207)

CVE-2026-24207 (sibling: CVE-2026-24206, Vertex AI, analysis only) network Patched

CVE-2026-24207networkCRITICAL 9.8Patched2026-07-05MantisBT SOAP `mc_issue_add` Authentication Bypass (Type Juggling) — CVE-2026-30849

CVE-2026-30849 web Patched

CVE-2026-30849webHIGHPatched2026-07-05LiteLLM Proxy Unauthenticated Auth Bypass via Host-Header Route Confusion (CVE-2026-49468)

CVE-2026-49468 web Patched

CVE-2026-49468webCRITICAL 9.8Patched2026-07-05Gitea Container Registry Anonymous Auth Bypass (CVE-2026-27771)

CVE-2026-27771 web Patched

CVE-2026-27771webCRITICALPatched2026-07-05Flowise NVIDIA NIM Endpoint Authentication Bypass — CVE-2026-30824 EPSS 36%

CVE-2026-30824 web Patched

CVE-2026-30824webCRITICAL 9.8Patched2026-07-05Budibase Authentication Bypass to Plugin-Upload Reverse Shell — CVE-2026-31816 EPSS 15%

CVE-2026-31816 web Unverified

CVE-2026-31816webCRITICALUnverified2026-07-05Apache Tomcat Split-Collection Security Constraint Bypass (CVE-2026-43515)

CVE-2026-43515 web Patched

CVE-2026-43515webHIGHPatched2026-07-05Apache Tomcat Mutual TLS OCSP Soft-Fail Authentication Bypass — CVE-2026-29145

CVE-2026-29145 web Patched

CVE-2026-29145webCRITICAL 9.1Patched2026-07-05AdminPanel 4.0 CSRF File Deletion / Setup-Mode Reset — CVE-2026-30498

CVE-2026-30498 (reserved by MITRE) web Unverified

CVE-2026-30498webHIGHUnverified2026-07-05PAN-OS GlobalProtect Authentication Bypass via Forged Cookie (CVE-2026-0257) KEV RW EPSS 94%

CVE-2026-0257 web Unverified

CVE-2026-0257webHIGH 7.8Unverified2026-07-01Ivanti Sentry Pre-Auth RCE + Auth Bypass (CVE-2026-10520 / CVE-2026-10523) KEV EPSS 100%

CVE-2026-10520, CVE-2026-10523 network Patched

CVE-2026-10520, CVE-2026-10523networkCRITICAL 10Patched2026-06-28Check Point Remote Access VPN IKEv1 Auth Bypass (CVE-2026-50751) KEV RW EPSS 84%

CVE-2026-50751 network Patched

CVE-2026-50751networkCRITICAL 9.3Patched2026-06-28ToolShell - SharePoint Unauthenticated RCE Chain KEV RW EPSS 100%

CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706 web Patched

CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706webCRITICALPatched2026-05-17Next.js Dynamic Route Injection Auth Bypass (CVE-2026-44574)

CVE-2026-44574 web Patched

CVE-2026-44574webHIGH 8.1Patched2026-05-17Fortinet FortiCloud SSO Authentication Bypass KEV EPSS 69%

CVE-2025-59718, CVE-2025-59719 (Advisory: FG-IR-25-647) network Unverified

CVE-2025-59718, CVE-2025-59719networkCRITICAL 9.8Unverified2026-05-17VMware ESXi Active Directory Authentication Bypass (CVE-2024-37085) KEV RW EPSS 27%

CVE-2024-37085 network Patched

CVE-2024-37085networkMEDIUM 6.8Patched2026-05-16Palo Alto PAN-OS Management Interface Authentication Bypass (CVE-2025-0108) KEV EPSS 98%

CVE-2025-0108 web Patched

CVE-2025-0108webCRITICAL 9.1Patched2026-05-16Fortinet FortiOS / FortiProxy Authentication Bypass (CVE-2024-55591) KEV RW EPSS 98%

CVE-2024-55591 (Fortinet FG-IR-24-535) web Unverified

CVE-2024-55591webCRITICAL 9.6Unverified2026-05-16cPanel & WHM Authentication Bypass via Session-File CRLF Injection (CVE-2026-41940) KEV RW EPSS 99%

CVE-2026-41940 web Patched

CVE-2026-41940webCRITICAL 10Patched2026-05-16Next.js Corrupt Middleware Auth Bypass (CVE-2025-29927) EPSS 99%

CVE-2025-29927 web Patched

CVE-2025-29927webCRITICAL 9.1Patched2026-05-15