8668 matches found
Improper Authentication
Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...
PT-2026-89644
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description Improper authentication may allow a remote authenticated attacker to bypass security restrictions and obtain sensitive information. Recommendations At the moment, there is no...
CVE-2026-77771: Improper Authentication
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...
CVE-2026-82107: Improper Authentication
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication...
PT-2026-89590
🚨 CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources. 🎖@cveNotify...
CVE-2026-88018: Improper Authentication
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88018: Improper Authentication
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88007: Improper Authentication
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection...
CVE-2026-88895: Improper Authentication
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
Improper Authentication
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication in the LDAP authentication process. An attacker can gain unauthorized access to user accounts by...
CVE-2026-79974
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...
CVE-2026-79974
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...
CVE-2026-79974
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...
EUVD-2026-74780
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...
CVE-2026-79974
Dell Secure Connect Gateway (SCG) 5.0 is affected by an Improper Authentication vulnerability in the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) versions. A low-privileged attacker with remote access could potentially exploit this flaw to gain unauthorized access , resul...
Improper Authorization
Netty is vulnerable to Improper Authentication. The vulnerability is due to incorrect offset validation when processing fragmented TLS ClientHello handshake headers, which allows an unauthenticated remote attacker to bypass SNI-specific mutual TLS authentication when no additional certificate...
CVE-2026-21097
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity...
CVE-2026-21097
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity...
CVE-2026-21097
CVE-2026-21097 is an improper authentication flaw in Samsung Mobile's ActivityTaskManagerService , present prior to SMR Sep-2026 Release 1 . A local privileged attacker can exploit it to launch an arbitrary activity , resulting in low impact to confidentiality, integrity, and availability on the ...