Advisories · Weakness
Authentication bypass.
Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Solaris
- Oracle Corporation Oracle Solaris
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Product Workbench
- Oracle Corporation Oracle Product Workbench
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Application Object Library
- Oracle Corporation Oracle Application Object Library
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Communications Billing and Revenue Management
- Oracle Corporation Oracle Communications Billing and Revenue Management
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Communications BRM - Elastic Charging Engine
- Oracle Corporation Oracle Communications BRM - Elastic Charging Engine
- Authentication bypass
- CVSS 6.5 Medium
Missing authentication in Oracle Corporation Oracle Communications Billing and Revenue Management
- Oracle Corporation Oracle Communications Billing and Revenue Management
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Helidon
- Oracle Corporation Helidon
- Authentication bypass
- CVSS 6.9 Medium
Improper authentication in Oracle Corporation Helidon
- Oracle Corporation Helidon
- Privilege escalation
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Solaris
- Oracle Corporation Oracle Solaris
- Authentication bypass
- CVSS 7.2 High
Missing authentication in Oracle Corporation Oracle EDI Gateway
- Oracle Corporation Oracle EDI Gateway
- Privilege escalation
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle APEX
- Oracle Corporation Oracle APEX
- Authentication bypass
- CVSS 7.2 High
Missing authentication in Oracle Corporation Oracle EDI Gateway
- Oracle Corporation Oracle EDI Gateway
- Privilege escalation
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle WebCenter Sites
- Oracle Corporation Oracle WebCenter Sites
- Authentication bypass
- CVSS 6.1 Medium
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing authentication in Oracle Corporation Oracle Secure Backup
- Oracle Corporation Oracle Secure Backup
- Authentication bypass
- CVSS 8.1 High
Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process
- Oracle Corporation Oracle Agile Product Lifecycle Management for Process
- Broken access control
- Authentication bypass
- CVSS 7.5 High
Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics
- Oracle Corporation Oracle Product Lifecycle Analytics
- SQL injection
- Privilege escalation
- CVSS 7.1 High
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 5.3 Medium
Missing authentication in Oracle Corporation Siebel CRM Cloud Applications
- Oracle Corporation Siebel CRM Cloud Applications
- Authentication bypass
- CVSS 5.9 Medium
Missing authentication in Oracle Corporation Siebel CRM Cloud Applications
- Oracle Corporation Siebel CRM Cloud Applications
- Authentication bypass
- CVSS 5.9 Medium
Missing authentication in Oracle Corporation Siebel CRM Cloud Applications
- Oracle Corporation Siebel CRM Cloud Applications
- Authentication bypass
- CVSS 8.0 High
Missing authentication in Oracle Corporation Siebel CRM Cloud Applications
- Oracle Corporation Siebel CRM Cloud Applications
- Authentication bypass
- CVSS 5.3 Medium
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 6.2 Medium
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 7.5 High
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 3.7 Low
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 7.5 High
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 3.7 Low
Missing authentication in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Authentication bypass
- CVSS 4.8 Medium
Missing authentication in Oracle Corporation Siebel Apps - Marketing
- Oracle Corporation Siebel Apps - Marketing
- Authentication bypass
- CVSS 8.1 High
Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools
- Oracle Corporation PeopleSoft Enterprise PeopleTools
- Authentication bypass
- CVSS 5.9 Medium
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
- Authentication bypass
<4.33.0 · fixed in 4.33.0
GHSA-653j-g8j7-gh54 · CVE-2026-113710 - CVSS 9.1 CriticalCritical · CVSS 9+
Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
- Xerj Console API
- Authentication bypass
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
- giuseppe99barchetta SuggestArr
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
- networknt light-4j
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
- Apache Software Foundation Apache Tomcat
- Authentication bypass
- CVSS 8.8 High
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
- Red Hat streams for Apache Kafka 2
- Red Hat streams for Apache Kafka 3
- Authentication bypass
- CVSS 8.7 High
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
- lavalite cms
- Authentication bypass
- CVSS 8.2 High
Unlimited authentication attempts in Advantech ADAM-3600
- Advantech ADAM-3600
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Improper authentication in Advantech ADAM-3600
- Advantech ADAM-3600
- Authentication bypass
- CVSS 7.5 High
Improper Signature Verification of Active Update Files
- Stormshield Network Security
- Authentication bypass
- CVSS 4.8 Medium
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
- CVSS 7.8 High
Improper Signature Verification of Firmware Update Files
- Stormshield Network Security
- Authentication bypass
- CVSS 5.3 Medium
Missing authentication in ASUS Router
- ASUS Router
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper authentication in Apple macOS
- Apple macOS
- Authentication bypass
- CVSS 2.0 Low
Improper authentication in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
- eosphoros-ai DB-GPT
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
- chatchat-space Langchain-Chatchat
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
- cas-bigdatalab piflow
- Authentication bypass
- CVSS 8.8 High
Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
- IBM TRIRIGA Application Platform
- Authentication bypass
- CVSS 5.5 Medium
TS4500 Tape Library Insufficient Session Expiration
- IBM Storage TS4500 Library
- Authentication bypass
- CVSS 6.3 Medium
TS4500 Tape Library Insufficient Session Expiration
- IBM Storage TS4500 Library
- Authentication bypass
- CVSS 7.1 High
Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
- TP-Link Systems Inc. Tapo C210 v3.6
- Authentication bypass
- CVSS 5.3 Medium
Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
- TP-Link Systems Inc. Tapo C210 v3.6
- Authentication bypass
- CVSS 8.8 High
Missing authentication in Dell Application Store
- Dell Application Store
- Authentication bypass
- CVSS 8.7 High
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
- cms
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
- CognicellAI Cognition
- Authentication bypass
- CWE-1188
- CVSS 6.5 Medium
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- WSO2 API Control Plane
- WSO2 Universal Gateway
- Authentication bypass
- CVSS 8.6 High
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
- Eptura Archibus
- Authentication bypass
- CVSS 6.9 Medium
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
- FOSSBilling
- Information disclosure
- Authentication bypass
- CVSS 6.4 Medium
Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue
- Netskope Inc. Netskope Client
- Authentication bypass