Advisories · Weakness

Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-76423 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Cisco ISE API Authentication Bypass Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92808 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- Altium Enterprise Server
- Authentication bypass
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2026
CVE-2026-20326 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function
- Cisco Nexus Dashboard
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-73443 CVE record

CVSS 5.3 Medium

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legiti…
- Arista Networks EOS
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92729 CVE record

CVSS 8.8 High

SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints
- signoz
- Authentication bypass
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-92720 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Kubero through 3.1.1 Unauthenticated Notifications API Access
- kubero
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92717 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
- cobbr Covenant
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-85387 CVE record

CVSS 2.0 Low

Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
- Concrete CMS
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92401 CVE record

CVSS 6.9 Medium

ChangeWeDer crm improper authentication
- ChangeWeDer crm
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-19607 CVE record

CVSS 5.3 Medium

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.16
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92625 CVE record

CVSS 7.5 High

Control iD iDSecure Unauthenticated Denial of Service
- Control iD iDSecure
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2025-43936 CVE record

CVSS 8.1 High

Improper authentication in Dell ObjectScale
- Dell ObjectScale
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92616 CVE record

CVSS 7.6 High

FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
- error311 FileRise
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92395 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
- @fastify/proxy-addr
- Authentication bypass
- CWE-348
Not analysed yet 16 Sept 2026
djust PyPI

CVSS 7.4 High

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
- Authentication bypass
- Information disclosure
<1.0.7 · fixed in 1.0.7

GHSA-8g2f-g3gq-5rjv · CVE-2026-61590 Not analysed yet 16 Sept 2026
CVE-2026-73173 CVE record

CVSS 8.8 High

Missing authentication in Advantech EKI-1242IEIMS and others
- Advantech EKI-1242IEIMS
- Advantech EKI-1242EIMS
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-40856 CVE record

CVSS 7.1 High

Config disclosure in T-Mobile 5G Box IDU routers
- WNC T-Mobile 5G Box IDU
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-40854 CVE record

CVSS 8.7 High

Session auth bypass via cookie value in T-Mobile 5G Box IDU routers
- WNC T-Mobile 5G Box IDU
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-86106 CVE record

CVSS 8.7 High

Security Advisory 0179
- Arista Networks VeloCloud Edge
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-14917 CVE record

CVSS 7.7 High

Kong API Gateway Enterprise: SAML Authentication bypass
- Kong Enterprise Gateway
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-76187 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
- Apache Software Foundation Apache Airflow Keycloak provider
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-82310 CVE record

CVSS 7.2 High

Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
- Apache Software Foundation Apache Airflow FAB provider
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-86462 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
- Apache Software Foundation Apache Airflow FAB provider
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-82311 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
- Apache Software Foundation Apache Airflow FAB provider
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-27546 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Authentication Bypass in _account_log
- Pepperl+Fuchs ICE2-8IOL1-G65L-V1D
- Pepperl+Fuchs ICE2-8IOL-G65L-V1D
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-88263 CVE record

CVSS 8.7 High

Missing authentication in XikeStor SKS8310-8X and others
- XikeStor SKS8310-8X
- XikeStor SKS8300-8T
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-89327 CVE record

CVSS 3.8 Low

FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter
- FluentBoards
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-92358 CVE record

CVSS 6.4 Medium

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
- Red Hat build of Keycloak 26.6.8
- Red Hat Single Sign-On 7
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-15640 CVE record

CVSS 9.5 CriticalCritical · CVSS 9+

Authentication Bypass via SAML Response Manipulation
- Delinea Secret Server (On-Prem)
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-73444 CVE record

CVSS 5.3 Medium

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP i…
- Arista Networks EOS
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-68070 CVE record

CVSS 8.7 High

Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- Digital Watchdog VMAX A1 G4 DVR
- Digital Watchdog VMAX IP G4 NVR
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-68953 CVE record

CVSS 7.1 High

Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
- Digital Watchdog VMAX A1 G4 DVR
- Digital Watchdog VMAX IP G4 NVR
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-88065 CVE record

CVSS 7.5 High

`tts-be` application has a Broken Access Control vulnerability
- NIAEFEUP tts-be
- Information disclosure
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87223 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87217 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87205 CVE record

CVSS 7.5 High

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87200 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87197 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87196 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87195 CVE record

CVSS 7.4 High

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87188 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87176 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87175 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87173 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87170 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87129 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Data Relationship Management
- Oracle Corporation Oracle Hyperion Data Relationship Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-87128 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Hyperion Data Relationship Management
- Oracle Corporation Oracle Hyperion Data Relationship Management
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83462 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Mobile Application Server
- Oracle Corporation Oracle Mobile Application Server
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83461 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle Mobile Application Server
- Oracle Corporation Oracle Mobile Application Server
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83452 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Document Management and Collaboration
- Oracle Corporation Oracle Document Management and Collaboration
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-89027 CVE record

CVSS 6.9 Medium

miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
- miniOrange JWT Authentication for WP REST APIs
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83355 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Enterprise Manager for Fusion Middleware
- Oracle Corporation Oracle Enterprise Manager for Fusion Middleware
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83343 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle Utilities Network Management System
- Oracle Corporation Oracle Utilities Network Management System
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83339 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle WebCenter Enterprise Capture
- Oracle Corporation Oracle WebCenter Enterprise Capture
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83334 CVE record

CVSS 7.4 High

Missing authentication in Oracle Corporation Oracle Web Services Manager
- Oracle Corporation Oracle Web Services Manager
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83327 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Applications Framework
- Oracle Corporation Oracle Applications Framework
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83305 CVE record

CVSS 8.6 High

Missing authentication in Oracle Corporation Oracle BI Publisher
- Oracle Corporation Oracle BI Publisher
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83283 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83269 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Missing authentication in Oracle Corporation Oracle BI Publisher
- Oracle Corporation Oracle BI Publisher
- Authentication bypass
Not analysed yet 15 Sept 2026
CVE-2026-83266 CVE record

CVSS 8.2 High

Missing authentication in Oracle Corporation Oracle JDeveloper
- Oracle Corporation Oracle JDeveloper
- Authentication bypass
Not analysed yet 15 Sept 2026