62868 matches found
CVE-2026-120209
The AJ-Report software (through version 1.7.1) is vulnerable to an authentication bypass leading to remote code execution (RCE) . The root cause is the use of a hard-coded JWT secret to sign share tokens, which allows attackers to forge valid tokens offline. By minting a token with the reportCode...
CVE-2026-120201
Jpom versions 2.10.0 through 2.11.12 are vulnerable to an authentication bypass that allows unauthenticated attackers to obtain super-administrator access . The root cause is the improper neutralization of special elements in data query logic (CWE-943); specifically, attackers can inject query co...
TrueConf Server Authentication Bypass
The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access under an arbitrary username without a password...
OLIMPOX Authentication Bypass Info Disclosure
The vulnerability of the software for the training and control system “OLIMPOX” is related to the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential information and modify data within...
CRM Platform Authentication Bypass
The vulnerability of the platform for creating individual web applications in CRM systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers, operating remotely, to circumvent existing security mechanisms and gain unauthorized access to...
Doctor Near Telemedicine Premium Authentication Bypass
The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
Doctor Around Telemedicine Premium Authentication Bypass Info Disclosure
The vulnerability of the “Doctor Around. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...
QAFA Firmware Authentication Bypass
The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...
Enlogic SCADA System ENTTEK Authentication Bypass
The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...
tomcat security update
An update is available for tomcat. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages...
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two security flaws impacting Ivanti Connect Secure ICS to its Known Exploited Vulnerabilities KEV catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 CVSS score: 8...
CVE-2026-119096
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...
CVE-2026-103898
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...
CVE-2026-103898 Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...
CVE-2026-103898
The Wp Social Login and Register Social Counter plugin for WordPress (versions up to and including 3.2.2 ) is vulnerable to an Authentication Bypass . The root cause lies in the social login REST callback at /wp-json/wslu-social-login/type/{provider}/, which uses permission_callback => __retur...
EUVD-2026-114656
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/provider/ with permissioncallback = returntrue...
CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...
CVE-2026-119096
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 3.8.2 . The vulnerability exists in the uo_login_action() function due to a parser-differential flaw involving the email parameter. While the plugin's account-verificat...
EUVD-2026-114649
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...
davscan
DAVScan DAVScan is a quick and lightweight webdav scanner designed to discover hidden files and folders on DAV enabled webservers. The scanner works by taking advantage of overly privileged/misconfigured WebDAV servers or servers vulnerable to various disclosure or authentication bypass...