#cwe-287

共收录 1077 条相关情报。

← 返回所有主题
漏洞预警2026-10-22 发布MEDIUM

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWT...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBeare

来源摘录 · NVD

漏洞预警2026-10-22 发布CRITICAL

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-lengt...

CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key()

来源摘录 · NVD / OSV.dev

漏洞预警2026-10-22 发布HIGH

A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive i...

CVE-2026-79884

A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypas

来源摘录 · NVD

漏洞预警2026-10-22 发布HIGH

An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls....

CVE-2026-79881

An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote

来源摘录 · NVD

漏洞预警2026-10-22 发布CRITICAL

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication control...

CVE-2026-79875

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjace

来源摘录 · NVD

漏洞预警2026-10-22 发布CRITICAL

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Success...

CVE-2026-79868

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacke

来源摘录 · NVD

漏洞预警2026-10-22 发布CRITICAL

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run ...

CVE-2026-79867

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacke

来源摘录 · NVD

漏洞预警2026-10-22 发布MEDIUM

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, there...

CVE-2026-114222

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can

来源摘录 · NVD

漏洞预警2026-10-22 发布INFO

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authentic...

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthe

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-22 发布INFO

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collid...

CVE-2026-114638

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · NVD

安全公告2026-10-22 发布INFO

Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthe

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-22 发布INFO

Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

CVE-2026-114638

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-21 发布INFO

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session...

CVE-2026-114439

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionali

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-21 发布INFO

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. ...

CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based AP

来源摘录 · NVD

安全公告2026-10-21 发布INFO

oretnom23 php-travel-agency-system Session session.php missing authentication

CVE-2026-114439

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionali

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-21 发布INFO

Laravel TokenGuard authentication bypass through non-string API credentials

CVE-2026-114509

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based AP

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-10-21 发布INFO

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action i...

CVE-2026-114438

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-21 发布CRITICAL

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication ...

CVE-2026-86249

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption

来源摘录 · NVD

漏洞预警2026-10-21 发布CRITICAL

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending...

CVE-2026-48830

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication

来源摘录 · NVD

漏洞预警2026-10-21 发布CRITICAL

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgr...

CVE-2026-58663

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: f

来源摘录 · NVD