CVE-2026-16656: Improper Authentication

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication...

CVE-2026-76338: Improper Authentication

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

CVE-2026-19709: Improper Authentication

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19842: Improper Authentication

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticat...

CVE-2026-16686: Improper Authentication

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication...

CVE-2026-62669: Improper Authentication

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user-authorized. After submitting a victim's correct password, an attacker can...

CVE-2026-18031: Improper Authentication

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-75774

Karakeep up to 0.32.0 has an improper authentication flaw in its OAuth Sign-In logic (file apps/web/server/auth.ts). Attack complexity is high and no patch has been released yet, as the project has not responded to the issue report. Exploitation details are not publicly provided in the documents.

EUVD-2026-60582

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

Exploit for Improper Authentication in Apple Macos

cve-id Donate Support the maintenance of this project wit...

CVE-2026-44472: Improper Authentication

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

CVE-2026-70905: Improper Authentication

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Agent infrastructure. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle...

CVE-2026-53958: Improper Authentication

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

CVE-2026-15315: Improper Authentication

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session token...

CVE-2026-21582: Improper Authentication

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfor...

CVE-2026-60679: Improper Authentication

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via T3, IIOP to...