agentprime: CWE-305

CVE-2026-112208: Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login

Thu, 05 Nov 2026 16:05:05 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

Thu, 29 Oct 2026 10:19:15 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-10537: Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

Tue, 27 Oct 2026 13:26:13 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-110883: WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Sun, 18 Oct 2026 11:00:29 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111283: BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

Thu, 15 Oct 2026 21:43:26 GMT

CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Fri, 09 Oct 2026 17:08:15 GMT

github.com/0xJacky/Nginx-UI >=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814, fixed in 1.9.10-0.20260728074558-95cd21b70814. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-103059: Gitea built-in SSH server authentication bypass through key case folding

Tue, 06 Oct 2026 19:22:57 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification

Wed, 30 Sep 2026 09:47:03 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap

Wed, 30 Sep 2026 09:43:47 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59563: HMAC Confirmation Token Unbinding in zscaler-mcp-server

Mon, 28 Sep 2026 12:54:52 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-88837: Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

Wed, 23 Sep 2026 17:45:31 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

Thu, 17 Sep 2026 13:09:43 GMT

ash_authentication >=4.3.8, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14, fixed in 4.15.0, 5.0.0-rc.14. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-86207: Authentication bypass leads to unauthorised access to N-central

Sat, 05 Sep 2026 19:12:06 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-81578: PaperCut MF/NG: Authentication Bypass

Fri, 28 Aug 2026 11:39:45 GMT

CVSS 8.8 (High). Critical: In CISA’s KEV catalogue since 31 Aug 2026: it is known to be exploited. CVSS score 8.8 (7.0 or more) and EPSS 0.85 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16895: Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

Thu, 27 Aug 2026 03:14:21 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78619: Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

Tue, 25 Aug 2026 21:21:08 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-53561: Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

Tue, 25 Aug 2026 10:12:53 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14600: Admin Account Takeover via Path Traversal in vsDesk

Wed, 19 Aug 2026 17:39:42 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19349: Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO sessi…

Sun, 16 Aug 2026 13:22:34 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-1621: Register Bypass in Universal Sotware's E-Municipality

Fri, 14 Aug 2026 14:08:37 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-65935: Bypassing passkey entry in legacy pairing

Thu, 13 Aug 2026 14:24:08 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19292: Bluetooth re-pairing with legitimate device can use lower security level

Thu, 13 Aug 2026 14:17:18 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-62427: sysctl and platform-op locks open to abuse

Tue, 28 Jul 2026 12:31:57 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16103: Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Fri, 17 Jul 2026 16:43:50 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9597: Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

Mon, 13 Jul 2026 08:17:36 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9571: Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

Mon, 13 Jul 2026 07:50:55 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-35159: Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability.

Fri, 03 Jul 2026 08:08:31 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-8932: incomplete mTLS config matching in conn reuse

Fri, 03 Jul 2026 06:16:30 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Rancher has Privilege Escalation from Project Owner to Host

Wed, 01 Jul 2026 20:57:49 GMT

github.com/rancher/rancher <0.0.0-20260513182521-2800aaac25b5 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.6 || >=2.14.0, <2.14.2, fixed in 0.0.0-20260513182521-2800aaac25b5, 2.12.10, 2.13.6, 2.14.2. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-10539: Unauthenticated command injection in Control-M/Server communication command

Wed, 01 Jul 2026 07:55:00 GMT

CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-4994: Authentication Bypass for SafeLine SL6 and SL6+

Mon, 22 Jun 2026 08:10:29 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-7064: Freelance Security Lock – Access to Windows OS

Thu, 11 Jun 2026 09:07:30 GMT

CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-25555: OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

Mon, 08 Jun 2026 16:53:37 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Keycloak has an Authentication Bypass by Primary Weakness

Thu, 28 May 2026 06:31:09 GMT

org.keycloak:keycloak-services <=26.4.7 || >=26.5.0, <=26.6.4, no fixed version yet. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-9047: Devolutions Server: Improper handling of factor key state in the multi-factor authentication management…

Fri, 22 May 2026 15:18:39 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-41054: Missing exit out of permission check in haveged could lead to root exploit

Wed, 20 May 2026 08:56:14 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

Mon, 18 May 2026 09:31:47 GMT

github.com/mattermost/mattermost-server <5.3.2-0.20260318173148-e9ae890a013b, fixed in 5.3.2-0.20260318173148-e9ae890a013b. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) ...

Fri, 15 May 2026 03:16:23 GMT

mlflow <3.10.0, fixed in 3.10.0. CVSS 8.6 (High). Critical: CVSS score 8.6 (7.0 or more) and EPSS 0.21 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-5545: wrong reuse of HTTP Negotiate connection

Wed, 13 May 2026 08:27:26 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-6266: Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

Mon, 04 May 2026 13:47:07 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-4670: Improper Authentication vulnerability in Progress MOVEit Automation

Thu, 30 Apr 2026 15:06:11 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

Tue, 28 Apr 2026 00:31:41 GMT

org.springframework.boot:spring-boot >=4.0.0, <4.0.6, fixed in 4.0.6. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-40582: ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout

Fri, 17 Apr 2026 23:16:13 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-33472: Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

Thu, 16 Apr 2026 21:12:37 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-20152: Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability

Wed, 15 Apr 2026 16:03:43 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-33892: Siemens Industrial Edge Management Pro V1: A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >=…

Tue, 14 Apr 2026 08:40:46 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-40039: Pachno 1.0.6 Open Redirection via return_to Parameter

Mon, 13 Apr 2026 18:10:55 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-3591: A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Wed, 25 Mar 2026 13:34:14 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

Mon, 23 Mar 2026 20:28:52 GMT

mantisbt/mantisbt <2.28.1, fixed in 2.28.1. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Ory Oathkeeper has an authentication bypass by cache key confusion

Fri, 20 Mar 2026 20:51:07 GMT

github.com/ory/oathkeeper <0.40.10-0.20260320084801-198a2bc82a99, fixed in 0.40.10-0.20260320084801-198a2bc82a99. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.