CVE-2021-45008

CVE-2021-45008 Privilege Escalation from user to admin Affected product and version: Plesk Obsidian 18.0.37 Severity: Critical Impact: Gain high privilege from user to admin and access critical information Description: insecure permissions vulnerability that allows unprivilege user to get admin...

cve-2025-24472-fortinet_authbypass_reproduction

CVE-2025-24472 — Fortinet FortiOS / FortiProxy Authentication Bypass Overview CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. An unauthenticated attacker can craft specially formed CSF Central Security Fabric proxy requests to gain super-admin privileg...

Loom for AWS < 1.6.1 - Unauthenticated Super-Admin Access

Loom for AWS 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured. id: CVE-2026-103956 info...

CVE-2026-126294

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

CVE-2026-126294 Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

EUVD-2026-125227

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofaenabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

CVE-2026-126294

The Grav Login plugin (versions before 3.11.0 ) contains an authentication bypass vulnerability. When the global twofa_enabled setting is disabled, an attacker possessing an account password can bypass two-factor verification by using the /login form, a remember-me cookie, or a magic link. This a...

EUVD-2026-125044

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin...

PT-2026-146625

Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a...

PT-2026-146547

Name of the Vulnerable Software and Affected Versions listmonk versions 6.0.0 through 7.0.0-beta.1 Description An authentication bypass exists in the doResetPassword function. The issue allows the TOTP Time-based One-Time Password verification step to be skipped following a password reset. An...

EUVD-2026-123906

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super adm...

EUVD-2026-123842

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

CVE-2026-126259

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super adm...

CVE-2026-126259

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super adm...

CVE-2026-126259

A missing authentication for critical functionality vulnerability (CWE-306 ) in Fortinet FortiOS affects versions 8.0.0 , 7.6.0 through 7.6.7 , 7.4.0 through 7.4.12 , and 7.2.0 through 7.2.13 . An unauthenticated attacker can execute commands as a super admin by sending crafted HA packets in envi...

CVE-2026-126180

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

CVE-2026-126259: Fortinet FortiOS: A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7,…

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super adm...

CVE-2026-126180: Fortinet: A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0…

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0...

PT-2026-145460

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256...

Unauthenticated adjacent command execution via HA

A missing authentication for critical function vulnerability CWE-306 in FortiOS may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets...