tag
Cwe-287
Critical
Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)
CVE-2025-65856·
Xiongmai XM530-based IP camera ONVIF service (tested on model XM530_50X50-WG_8M)
unpatched
Critical
WP Directory Kit Auto-Login Authentication Bypass to Full Site Takeover (CVE-2025-13390)
CVE-2025-13390·
WP Directory Kit (WordPress plugin)
unpatched
Critical
RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)
CVE-2025-9209·
RestroPress – Online Food Ordering System (WordPress plugin)
unpatched
Critical
PrestaShop Checkout Zero-Click Account Takeover via ExpressCheckout Endpoint (CVE-2025-61922)
CVE-2025-61922·
PrestaShop Checkout module (ps_checkout)
unpatched
Critical
Oracle Identity Manager `;.wadl` Authentication Bypass + Groovy Script RCE (CVE-2025-61757)
CVE-2025-61757·
Oracle Identity Manager (OIM) — applicationmanagement REST API
unpatched
Critical
JAY Login & Register "Switch Back" Cookie Authentication Bypass (CVE-2025-14440)
CVE-2025-14440·
JAY Login & Register (WordPress plugin)
unpatched
Critical
Grafana Enterprise SCIM User ID Collision / Impersonation (CVE-2025-41115)
CVE-2025-41115·
Grafana Enterprise / Grafana Cloud, SCIM provisioning component (/api/scim/v2/Users)
unpatched
Critical
FreePBX Framework Module Authentication Bypass via Forged Authorization Header (CVE-2025-66039)
CVE-2025-66039·
FreePBX (Sangoma) framework module — web-based administration panel for Asterisk-based VoIP/PBX systems
patched
Critical
CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)
CVE-2025-54309·
CrushFTP server, AS2 (Applicability Statement 2) authentication module / web admin interface
patched
Critical
Rack::Session::Cookie Decrypt-Failure Fallback to Unencrypted Cookies (CVE-2026-39324)
CVE-2026-39324 / GHSA-33qg-7wpp-89cq·
rack-session (RubyGems), Rack::Session::Cookie with secrets: option
patched
Medium
PocketBase OAuth2 Account Pre-Hijacking (CVE-2026-44166)
CVE-2026-44166 / [GHSA-pq7p-mc74-g65w](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w)·
[PocketBase](https://github.com/pocketbase/pocketbase) (Go backend / BaaS)
unpatched
Critical
LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030)
CVE-2026-35030·
LiteLLM proxy (with enable_jwt_auth: true)
patched
Critical
HPE Aruba AOS-CX Pre-Auth REST API Bypass via nginx Version Smuggling (CVE-2026-23813)
CVE-2026-23813·
HPE Aruba Networking AOS-CX
patched
Critical
Burst Statistics WordPress Plugin Authentication Bypass to Admin Account Takeover (CVE-2026-8181)
CVE-2026-8181·
Burst Statistics – Privacy-Friendly WordPress Analytics (burst-statistics plugin)
patched