tag

Authentication Bypass

Kestra Authentication Bypass to RCE (CVE-2026-49869)

CVE-2026-49869, CVE-2026-53576 web Unverified

CVE-2026-49869, CVE-2026-53576webCRITICAL 10Unverified2026-09-03Ivanti Endpoint Manager Mobile (EPMM) Unauthenticated Remote API Access (CVE-2023-35078) KEV RW EPSS 100%

CVE-2023-35078 (Ivanti advisory; CWE-287 per NVD) network Unverified

CVE-2023-35078networkCRITICAL 9.8Unverified2026-08-09Check Point Security Management / Multi-Domain Server SmartConsole Authentication Bypass via Forged Application Certificate Bind (CVE-2026-16232) KEV EPSS 72%

CVE-2026-16232 network Patched

CVE-2026-16232networkCRITICAL 9.1Patched2026-08-09CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass (vamp-forticheck Scanner) KEV RW EPSS 100%

CVE-2022-40684 network Unverified

CVE-2022-40684networkCRITICAL 9.8Unverified2026-07-31SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558) KEV EPSS 12%

CVE-2026-48558 web Patched

CVE-2026-48558webCRITICAL 10Patched2026-07-19Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271)

CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8) web Patched

CVE-2026-56271webCRITICAL 9.8Patched2026-07-12Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)

CVE-2026-20896 (GHSA-f75j-4cw6-rmx4) web Patched

CVE-2026-20896webCRITICAL 9.8Patched2026-07-11WP Directory Kit Auto-Login Authentication Bypass to Full Site Takeover (CVE-2025-13390)

CVE-2025-13390 web Patched

CVE-2025-13390webCRITICAL 10Patched2026-07-06WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901)

CVE-2025-49901 web Patched

CVE-2025-49901webCRITICAL 9.8Patched2026-07-06WordPress Service Finder Bookings ≤ 6.0 Authentication Bypass via `original_user_id` Cookie (CVE-2025-5947)

CVE-2025-5947 web Unverified

CVE-2025-5947webCRITICAL 9.8Unverified2026-07-06WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)

CVE-2025-68860 web Unpatched

CVE-2025-68860webCRITICAL 9.8Unpatched2026-07-06SmarterMail Auth Bypass via Password Reset to Pre-Auth RCE (CVE-2025-52691 / WT-2026-0001) KEV RW EPSS 86%

CVE-2025-52691 web Patched

CVE-2025-52691webCRITICAL 10Patched2026-07-06RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926) EPSS 31%

CVE-2025-68926 cloud Patched

CVE-2025-68926cloudCRITICAL 9.8Patched2026-07-06RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)

CVE-2025-9209 web Unpatched

CVE-2025-9209webCRITICAL 9.8Unpatched2026-07-06Oracle Identity Manager `;.wadl` Authentication Bypass + Groovy Script RCE (CVE-2025-61757) KEV EPSS 88%

CVE-2025-61757 web Unpatched

CVE-2025-61757webCRITICAL 9.8Unpatched2026-07-06Mitel MiCollab Path Normalization Bypass to Internal Endpoints (CVE-2025-52913)

CVE-2025-52913 network Unverified

CVE-2025-52913networkCRITICAL 9.8Unverified2026-07-06JAY Login & Register "Switch Back" Cookie Authentication Bypass (CVE-2025-14440)

CVE-2025-14440 web Unverified

CVE-2025-14440webCRITICAL 9.8Unverified2026-07-06Gladinet CentreStack / Triofox Hardcoded AES Key Access-Ticket Forgery to Arbitrary File Read (CVE-2025-14611) KEV EPSS 53%

CVE-2025-14611 web Unverified

CVE-2025-14611webCRITICAL 9.8Unverified2026-07-06FreePBX Framework Module Authentication Bypass via Forged Authorization Header (CVE-2025-66039)

CVE-2025-66039 network Patched

CVE-2025-66039networkCRITICAL 9.8Patched2026-07-06FortiWeb `cgi-bin/fwbcgi` Path Traversal Authentication Bypass Leading to Rogue Admin Creation (CVE-2025-64446) KEV EPSS 92%

CVE-2025-64446 network Unverified

CVE-2025-64446networkCRITICAL 9.8Unverified2026-07-06FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718) KEV EPSS 69%

CVE-2025-59718 (Fortinet advisory FG-IR-25-647; related: CVE-2025-59719) network Patched

CVE-2025-59718networkCRITICAL 9.8Patched2026-07-06CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309) KEV EPSS 95%

CVE-2025-54309 web Patched

CVE-2025-54309webCRITICAL 9Patched2026-07-06Apache mod_ssl TLS 1.3 Session Resumption Client Certificate Bypass (CVE-2025-23048)

CVE-2025-23048 web Patched

CVE-2025-23048webCRITICAL 9.1Patched2026-07-06Apache Druid Kerberos Cookie-Signing Secret Recovery via ThreadLocalRandom Seed Inversion (CVE-2025-59390)

CVE-2025-59390 crypto Patched

CVE-2025-59390cryptoCRITICAL 9.8Patched2026-07-06YAMCS LdapAuthModule LDAP Injection Authentication Bypass (CVE-2026-42568)

CVE-2026-42568 / GHSA-cqh3-jg8p-336j network Patched

CVE-2026-42568 / GHSA-cqh3-jg8p-336jnetworkMEDIUMPatched2026-07-05SmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760) KEV RW EPSS 96%

CVE-2026-23760 web Patched

CVE-2026-23760webCRITICAL 9.3Patched2026-07-05Rack::Session::Cookie Decrypt-Failure Fallback to Unencrypted Cookies (CVE-2026-39324)

CVE-2026-39324 / GHSA-33qg-7wpp-89cq web Patched

CVE-2026-39324 / GHSA-33qg-7wpp-89cqwebCRITICALPatched2026-07-05Nextcloud user_oidc ID4me JWT Signature Bypass (CVE-2026-45156)

CVE-2026-45156 web Patched

CVE-2026-45156webHIGH 8.1Patched2026-07-05LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030)

CVE-2026-35030 web Patched

CVE-2026-35030webCRITICAL 9.1Patched2026-07-05Keycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529

CVE-2026-1529 web Unverified

CVE-2026-1529webCRITICALUnverified2026-07-05JeecgBoot mLogin Endpoint CAPTCHA Bypass Enabling Credential Brute Force (CVE-2026-8196)

CVE-2026-8196 web Unverified

CVE-2026-8196webHIGHUnverified2026-07-05HPE Aruba AOS-CX Pre-Auth REST API Bypass via nginx Version Smuggling (CVE-2026-23813)

CVE-2026-23813 network Patched

CVE-2026-23813networkCRITICAL 9.8Patched2026-07-05Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)

CVE-2026-10580 web Unverified

CVE-2026-10580webCRITICAL 9.8Unverified2026-07-05GNU inetutils telnetd Local Privilege Escalation via NEW-ENVIRON Injection — CVE-2026-28372

CVE-2026-28372 binary Patched

CVE-2026-28372binaryHIGH 7.4Patched2026-07-05Form Notify WordPress Plugin — LINE OAuth Authentication Bypass to Account Takeover (CVE-2026-5229)

CVE-2026-5229 web Patched

CVE-2026-5229webCRITICAL 9.8Patched2026-07-05diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)

CVE-2026-38934 web Unverified

CVE-2026-38934webHIGH 8.8Unverified2026-07-05CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)

CVE-2026-37749 web Unverified

CVE-2026-37749webCRITICAL 9.8Unverified2026-07-05Cisco Catalyst SD-WAN Peering Authentication Bypass — CVE-2026-20182 KEV EPSS 92%

CVE-2026-20182 network Patched

CVE-2026-20182networkCRITICAL 10Patched2026-07-05Burst Statistics WordPress Plugin Authentication Bypass to Admin Account Takeover (CVE-2026-8181) EPSS 15%

CVE-2026-8181 web Patched

CVE-2026-8181webCRITICAL 9.8Patched2026-07-05Apache HTTP Server mod_auth_digest Timing Attack — CVE-2026-33006

CVE-2026-33006 web Patched

CVE-2026-33006webMEDIUM 4.8Patched2026-07-05Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908

CVE-2026-31908 web Patched

CVE-2026-31908webCRITICAL 10Patched2026-07-05Apache Airflow AWS Auth Manager SAML Host Header Injection (CVE-2026-25604)

CVE-2026-25604 web Patched

CVE-2026-25604webHIGHPatched2026-07-05AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729

CVE-2026-1729 web Unverified

CVE-2026-1729webCRITICALUnverified2026-07-05NodeBB ActivityPub attributedTo Local UID Spoof

None assigned as of 2026-07-03 web Unverified

None assigned as of 2026-07-03webHIGHUnverified2026-07-03Fortinet FortiClient EMS Pre-Auth Bypass — "FortiBleed" (CVE-2026-35616) KEV EPSS 91%

CVE-2026-35616 network Patched

CVE-2026-35616networkCRITICAL 9.1Patched2026-07-03libcurl mTLS Connection Reuse Authentication Bypass (CVE-2026-8932)

CVE-2026-8932 network Patched

CVE-2026-8932networkLOWPatched2026-06-30GNU Inetutils telnetd Unauthenticated Root RCE via NEW-ENVIRON (CVE-2026-24061) KEV EPSS 98%

CVE-2026-24061 network Patched

CVE-2026-24061networkCRITICAL 9.8Patched2026-06-30