Advisories · Weakness

Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-83261 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics
- Oracle Corporation Oracle Product Lifecycle Analytics
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83252 CVE record

CVSS 7.0 High

Missing authentication in Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience…
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83232 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Data Integrator
- Oracle Corporation Oracle Data Integrator
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83202 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83201 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Siebel CRM Deployment
- Oracle Corporation Siebel CRM Deployment
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83197 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Siebel Apps - Financial Services
- Oracle Corporation Siebel Apps - Financial Services
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83154 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Siebel CRM End User
- Oracle Corporation Siebel CRM End User
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83151 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Service Delivery Platform
- Oracle Corporation Service Delivery Platform
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83115 CVE record

CVSS 7.5 High

Missing authentication in Oracle Corporation Oracle Applications Manager
- Oracle Corporation Oracle Applications Manager
- Authentication bypass
- CWE-1284
Not analysed yet 15 Sept 2026
CVE-2026-83108 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83104 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83100 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83099 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83098 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83095 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83094 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Forms
- Oracle Corporation Oracle Forms
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83066 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83062 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83061 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83060 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83059 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83054 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Internet Directory
- Oracle Corporation Oracle Internet Directory
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83042 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Identity Manager
- Oracle Corporation Oracle Identity Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83037 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Sites
- Oracle Corporation Oracle WebCenter Sites
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83036 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Sites
- Oracle Corporation Oracle WebCenter Sites
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83035 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Sites
- Oracle Corporation Oracle WebCenter Sites
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83021 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebLogic Server
- Oracle Corporation Oracle WebLogic Server
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83020 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Platform Security for Java
- Oracle Corporation Oracle Platform Security for Java
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83000 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Service Delivery Platform
- Oracle Corporation Service Delivery Platform
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-82995 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Platform Security for Java
- Oracle Corporation Oracle Platform Security for Java
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-82994 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Platform Security for Java
- Oracle Corporation Oracle Platform Security for Java
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73963 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Portal
- Oracle Corporation Oracle WebCenter Portal
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73961 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle JDeveloper
- Oracle Corporation Oracle JDeveloper
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73956 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Portal
- Oracle Corporation Oracle WebCenter Portal
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73953 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Portal
- Oracle Corporation Oracle WebCenter Portal
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73952 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Portal
- Oracle Corporation Oracle WebCenter Portal
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73950 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Access Manager
- Oracle Corporation Oracle Access Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73947 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Access Manager
- Oracle Corporation Oracle Access Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73944 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Access Manager
- Oracle Corporation Oracle Access Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73940 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Access Manager
- Oracle Corporation Oracle Access Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-71133 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Access Manager
- Oracle Corporation Oracle Access Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-70913 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Identity Manager
- Oracle Corporation Oracle Identity Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-70757 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebLogic Server
- Oracle Corporation Oracle WebLogic Server
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-70756 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebLogic Server
- Oracle Corporation Oracle WebLogic Server
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-70748 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebLogic Server
- Oracle Corporation Oracle WebLogic Server
- Authentication bypass
Not analysed yet 15 Sept 2026
org.http4s:http4s-client_2.12 +2 Maven

CVSS 6.8 Medium

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain
- Authentication bypass
- CWE-565
<0.23.35 · fixed in 0.23.35

GHSA-wv64-j4fq-5f9x · CVE-2026-69214 Not analysed yet 15 Sept 2026
org.http4s:http4s-ember-core_2.12 +2 Maven

CVSS 5.9 Medium

Http4s: DigestAuth allows replay of captured requests
- Authentication bypass
<0.23.35 · fixed in 0.23.35

GHSA-9xww-74xv-gjfp · CVE-2026-69206 Not analysed yet 15 Sept 2026
CVE-2026-73458 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may…
- Arista Networks EOS
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-76701 CVE record

CVSS 5.9 Medium

Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-76688 CVE record

CVSS 7.5 High

Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-76684 CVE record

CVSS 8.1 High

Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-76673 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Authentication bypass
Not analysed yet 15 Sept 2026
code.vikunja.io/api Go

CVSS 7.5 High

Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
- Authentication bypass
<=2.5.0 · no fixed version yet

GHSA-p2vv-wrh8-x466 Withdrawn Not analysed yet 15 Sept 2026
github.com/go-vikunja/vikunja Go

CVSS 7.5 High

Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
- Authentication bypass
<=2.5.0 · no fixed version yet

GHSA-m4vj-wr5q-cmvr Withdrawn Not analysed yet 15 Sept 2026
CVE-2026-81237 CVE record

CVSS 6.5 Medium

Improper authentication in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-81238 CVE record

CVSS 7.5 High

Missing authentication in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-12910 CVE record

CVSS 5.4 Medium

Missing Authentication for Critical Function in GitLab
- GitLab
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-18111 CVE record

CVSS 8.5 High

Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
- Concrete CMS
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-89022 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion
- bookstack
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-92082 CVE record

CVSS 6.3 Medium

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
- Payara Server
- Authentication bypass
Not analysed yet 15 Sept 2026