AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
CVE-2026-108548
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that
#cwe-287
共收录 1077 条相关情报。
← 返回所有主题The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-logi...
CVE-2026-104803
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.2
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to,...
CVE-2026-104759
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentic
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attacker...
CVE-2026-94256
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified on
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short num...
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registra
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and ...
CVE-2026-104797
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass v
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_...
CVE-2026-104732
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an Open...
CVE-2026-62367
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator e
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
CVE-2026-62367
## Summary With the per-provider OIDC `emailfallback` option enabled, Vikunja links an SSO login to a pre-existing **lo
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that...
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthent
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automat...
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthent
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachab
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808
## Summary nginx-ui supports two second-factor methods — TOTP (OTP) and WebAuthn passkeys — and reports an account as 2
pyLoad has an authentication bypass in API key validation (check_apikey cache)
## Summary The API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long a
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasske...
CVE-2026-107808
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but
Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
CVE-2026-108157
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthent
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response ...
CVE-2026-108108
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Passwor
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but
An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c)...
CVE-2026-107910
An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the...
CVE-2026-105672
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher o