MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored s...

CVE-2026-9084

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based

历史摘要 · 未重新核验 · NVD

The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions...

CVE-2026-6456

The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

历史摘要 · 未重新核验 · GitHub Advisory

The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.2. This is due to the `rememberLogin` REST API endpoint...

CVE-2026-6456

The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

历史摘要 · 未重新核验 · NVD

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

## Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-ini

历史摘要 · 未重新核验 · GitHub Advisory

An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem ...

CVE-2026-36829

An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7.

历史摘要 · 未重新核验 · NVD

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users a...

CVE-2026-45434

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution T

历史摘要 · 未重新核验 · NVD

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the ...

CVE-2026-31387

Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are rec

历史摘要 · 未重新核验 · NVD

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to...

CVE-2026-42822

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove

历史摘要 · 未重新核验 · GitHub Advisory

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-42822

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove

历史摘要 · 未重新核验 · NVD

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

CVE-2026-45363

`JWT.decode(token, '', true, algorithm: 'HS256')` accepts an attacker-forged token. `OpenSSL::HMAC.digest('SHA256', '',

历史摘要 · 未重新核验 · GitHub Advisory

eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

### Impact In eduMFA = 2.9.1 by adding validity information to the userless challenges. ### Workarounds No known workar

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the su...

CVE-2026-44551

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the L

历史摘要 · 未重新核验 · NVD

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shar...

## Summary **Type:** Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpo

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE

### Am I affected? Users are affected if all of the following are true: - The application uses `better-auth` at a vers

历史摘要 · 未重新核验 · GitHub Advisory

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and...

CVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This

历史摘要 · 未重新核验 · GitHub Advisory

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie dat...

CVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This

历史摘要 · 未重新核验 · NVD

slack-go `SecretsVerifier` accepts empty signing secret without precondition

```go func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) { hash := hmac.New(sha256.

历史摘要 · 未重新核验 · GitHub Advisory

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other owners or organizations by spoofing iden...

CVE-2026-8621

Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to i

历史摘要 · 未重新核验 · NVD

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new a...

CVE-2026-20182

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fi

历史摘要 · 未重新核验 · NVD

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1...

CVE-2026-8181

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulne

历史摘要 · 未重新核验 · NVD