共收录 36 条相关情报。
← 返回所有主题CVE-2026-115967
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication
CVE-2025-30414
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cl
CVE-2026-85939
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
CVE-2026-83674
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing
CVE-2026-83657
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally
CVE-2026-83586
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to eleva
CVE-2026-83511
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing
CVE-2026-70005
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security
CVE-2026-96940
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
CVE-2026-96940
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured ide
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured ide
CVE-2026-92289
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKC
CVE-2026-92288
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth
CVE-2026-94455
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The a
CVE-2026-94455
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The a
CVE-2026-62895
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges
CVE-2026-80219
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthC
CVE-2026-73819
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifyin
CVE-2026-44476
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically register