FearlessCMS versions prior to 0.1.4 contain multiple unauthenticated debug/test PHP scripts under the admin directory that allow privileged operations without authentication or CSRF protection. These scripts enable attackers to bypass admin login via crafted URIs, perform arbitrary file writes and reads including path traversal, execute stored cross-site scripting, enumerate directories, and cause disk exhaustion. The vulnerability allows site defacement, session theft, and potential full system compromise when PHP runs with elevated privileges. The issue is fixed in version 0.1.4.
CVE-2026-107671 is a high-severity vulnerability in Veeam ONE versions 13.1 through 13.1.0.7233 that allows an attacker with valid Administrator credentials to bypass multi-factor authentication (MFA). The attacker can disable MFA globally before completing the MFA verification process, effectively circumventing this security control.
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.
CVE-2026-114732 is an authentication bypass vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in multi-host setups where logging in with an alias address could incorrectly authenticate a user to an account on a different IMAP host due to improper qualification of the alias lookup. This issue was fixed by qualifying alias logins by IMAP host in the code.
CVE-2026-84923 is an authentication bypass vulnerability in the Drupal Email Verification / SMS Verification / OTP Verification component. It affects versions from 0.0.0 up to but not including 2.4.0. The flaw allows an attacker to bypass authentication by using an alternate path or channel. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.4.0.
CVE-2026-96385 is an authentication bypass vulnerability in the REST & JSON API Authentication module for Drupal. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability allows an attacker to bypass authentication using an alternate path or channel. This issue has a medium severity with a CVSS score of 6.5. A fix is available in version 3.2.0.
CVE-2026-96387 is an authentication bypass vulnerability in the Drupal Stop administrator login module affecting versions 1.0 through 1.5. The flaw allows an attacker with high privileges to bypass authentication using an alternate path or channel. The vulnerability has a low severity rating with a CVSS score of 3.8. A fix is available in version 1.6.
CVE-2026-111438 is an authentication bypass vulnerability in openGauss-server affecting versions 3.0.0 through 6.0.6 and certain release candidates. The flaw exists in the handling of replication connections for HADR/SW senders, where internal connection checks are bypassed, allowing unauthorized replication connections from non-internal networks. This enables attackers to bypass pg_hba access control policies and potentially read backup and log data via the replication protocol. The issue is fixed in version 7.0.0-LTS by enforcing internal connection validation for replication senders.
CVE-2026-89057 is a high-severity authentication bypass vulnerability affecting Lenovo Idea Tab Pro (TB373FU) tablets. It allows a user with physical access to bypass authentication and gain unauthorized access to the device. The vulnerability is identified as CWE-288, involving authentication bypass via an alternate path or channel. Multiple firmware versions prior to 17.5.10.362 are affected. No vendor patch or remediation details are provided in the available data.
CVE-2026-19863 is a critical vulnerability in EthereumAuthenticator affecting versions 12.1.0 through 12.1.12. It allows an unauthenticated client to access certain protected resources if the request path contains the configured login path as a later segment. This occurs because the authenticator uses an unanchored substring match to identify the login page, causing it to mistakenly treat protected resource requests as login requests and bypass authentication or role checks. Explicitly forbidden routes are not affected.
CVE-2026-89067 is an authentication bypass vulnerability in Progress MOVEit Transfer that allows attackers to bypass authentication using an alternate path or channel. It affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a high severity with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.
CVE-2026-85865 is an authentication bypass vulnerability in the Windows DHCP Server component affecting multiple versions of Microsoft Windows 10 and Windows Server. It allows a locally authorized attacker to bypass a security feature due to improper authentication handling. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue in the affected versions.
CVE-2026-83787 is a medium-severity vulnerability in Microsoft Windows 10 Version 1607 and related versions. It involves insufficient verification of data authenticity in the Windows DHCP Server component, allowing a local authorized attacker to bypass a security feature. The vulnerability affects multiple Windows versions prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-11731 is an authentication bypass vulnerability in NETGEAR RAX30 devices that allows an unauthenticated attacker with adjacent network access to the device's management service to access or modify administrative settings. This vulnerability affects versions prior to 1.0.15.110 and may compromise the confidentiality, integrity, and availability of device management functions.
IBM Planning Analytics versions 2.0 and 2.1 contain an authentication bypass vulnerability that could allow a remote attacker with limited privileges to gain unauthorized administrative access. This issue arises from improper authentication handling, classified under CWE-288. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability.
IBM Planning Analytics versions 2.0 and 2.1 contain an authentication bypass vulnerability due to improper validation of sub-requests. This flaw could allow a remote attacker with some privileges to bypass authentication controls and escalate their privileges. The vulnerability is classified under CWE-288 and has a high severity rating with a CVSS score of 8.8.
CVE-2026-84360 is an authentication bypass vulnerability in 0xJacky's nginx-ui product that allows OTP-enabled users to bypass the intended secure session requirement for high-impact Nginx configuration changes. The vulnerability arises because the MCP endpoints, which allow configuration mutations, require only ordinary authentication rather than the stricter secure session. This enables an attacker with valid JWT authentication but without a secure session to modify Nginx configuration via the /mcp and /mcp_message endpoints. The issue was verified with a proof-of-concept demonstrating successful configuration changes without step-up authentication.
CVE-2026-62038 is a high-severity authentication bypass vulnerability affecting DigitalME eRoom versions up to 1.7.1. It allows unauthenticated attackers to bypass authentication mechanisms, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impact. No specific affected versions beyond <=1.7.1 are provided. There is no information on available patches or vendor advisories. The vulnerability is identified as CWE-288, indicating broken authentication via an alternate path or channel.