Export limit exceeded: 398479 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 398479 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (692 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-24254 | 2 Linux, Nvidia | 2 Linux Kernel, Dynamo | 2026-08-05 | 9.8 Critical |
| NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | ||||
| CVE-2026-18556 | 1 N-able | 1 N-central | 2026-08-05 | 7.4 High |
| Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. | ||||
| CVE-2026-58073 | 1 Veeam | 1 Service Provider Console | 2026-08-04 | N/A |
| A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | ||||
| CVE-2026-18577 | 1 N-able | 1 N-central | 2026-08-04 | 8.1 High |
| An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | ||||
| CVE-2026-12167 | 1 Little Orbit | 1 Gamefirst Anti-cheat | 2026-08-04 | 7.8 High |
| The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver functionality via a communication interface that lacks appropriate access restrictions. | ||||
| CVE-2026-67337 | 1 Better-auth | 2 Better-auth\/oauth-provider, Better Auth | 2026-08-03 | 6.5 Medium |
| better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching. | ||||
| CVE-2026-33591 | 1 Tranquil It Systems | 1 Wapt Server | 2026-08-03 | N/A |
| A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account. | ||||
| CVE-2026-18574 | 1 Checkpoint | 2 Multi-domain Security Management Server, Security Management Server | 2026-08-03 | N/A |
| An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation. | ||||
| CVE-2026-59524 | 2 Sandhillsdev, Wordpress | 2 Easy Digital Downloads, Wordpress | 2026-08-02 | 6.5 Medium |
| Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. | ||||
| CVE-2026-59545 | 2 Miniorange, Wordpress | 2 Discord Integration, Wordpress | 2026-08-02 | 8.1 High |
| Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | ||||
| CVE-2026-24207 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-08-02 | 9.8 Critical |
| NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure. | ||||
| CVE-2026-20459 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-08-02 | 5.3 Medium |
| In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842. | ||||
| CVE-2026-20460 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-08-02 | 5.3 Medium |
| In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788. | ||||
| CVE-2026-57867 | 1 Microrealestate | 1 Microrealestate | 2026-07-31 | N/A |
| MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3. | ||||
| CVE-2026-36028 | 2026-07-31 | 6.8 Medium | ||
| A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions via a factory reset | ||||
| CVE-2026-47481 | 1 Nvidia | 1 Triton Inference Server | 2026-07-31 | 6.5 Medium |
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | ||||
| CVE-2026-12703 | 1 Teamviewer | 3 One, Remote, Tensor | 2026-07-30 | 8 High |
| TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host. | ||||
| CVE-2026-8338 | 1 Black Duck | 1 Coverity | 2026-07-30 | N/A |
| A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity. | ||||
| CVE-2026-15014 | 2 Cozyvision1, Wordpress | 2 Sms Alert – Sms & Otp For Woocommerce, Order Notifications & Abandoned Cart Recovery, Wordpress | 2026-07-28 | 9.8 Critical |
| The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators. | ||||
| CVE-2026-18047 | 1 Redhat | 2 Certificate System, Enterprise Linux | 2026-07-28 | 6.5 Medium |
| A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service. | ||||