CVE-2026-90465 is an authentication bypass vulnerability in WatchGuard Fireware OS affecting the FireCluster Sync processing. An attacker on the cluster interconnect, such as a compromised cluster peer or an on-path attacker, can send specially crafted requests to perform privileged firewall management actions as root. This flaw affects multiple versions prior to fixed releases in 2026.4, 12.12.4, and 12.5.22. The vulnerability has a high severity CVSS score of 8.7.
Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass.
This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.
CVE-2026-82117 is a critical authentication bypass vulnerability affecting Hitachi HiRDB Server Version 10 and certain versions of Version 9. The flaw allows an attacker to bypass authentication by spoofing, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects versions from 10-00 up to but not including 10-12-01, and multiple versions of HiRDB Server Version 9 and its variants. A fix is available in version 10-12-01.
CVE-2026-76938 is a critical authentication bypass vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This flaw allows an attacker to bypass authentication mechanisms by spoofing, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. A fixed version, 13-50-31, is available to remediate this issue.
The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication (2FA) by spoofing client IP address headers. An attacker who has obtained a user's password can spoof whitelisted IP addresses via the Client-IP and X-Forwarded-For headers, bypassing the second authentication factor. This issue was fixed in commit 4640889.
CVE-2026-70381 is an authentication bypass vulnerability in the web server configuration of WolfVision Cynap devices. It allows unauthenticated remote attackers with network access to the web interface to access certain on-device resources intended only for local use. These accessible resources do not include credentials or administrative functions but may expose non-public device content such as screen-saver content or web interface assets. The issue affects multiple Cynap product lines and has been assigned a medium severity with a CVSS score of 6.9. Fixed versions are available.
CVE-2026-115933 is a critical authentication bypass vulnerability in GitroomHQ's postiz-app affecting versions from 2.15.0 up to but not including 2.25.3. The application uses a single shared secret to sign multiple types of tokens (session, invitation, password reset) without distinguishing token purposes. This flaw allows an attacker to craft a valid signed token with arbitrary claims, which the application accepts as legitimate for various sensitive operations including session authentication, organization invitations with chosen roles, password resets, and enterprise provisioning. A narrower related flaw affects team invitation creation. The vulnerability has a CVSS score of 9.9 and is fixed in version 2.25.3.
CVE-2026-93629 is an authentication bypass vulnerability in Zimbra Collaboration Suite (ZCS) versions up to 10.1.21. It allows an unauthenticated attacker to send calendar invitations forged as another user by exploiting the lack of verification of the iCalendar ORGANIZER identity in incoming emails. This can result in recipients receiving and automatically inserting malicious calendar events without interaction, although no event is created in the forged organizer's calendar.
Zimbra Collaboration Suite (ZCS) versions up to 10.1.21 contain an authentication bypass vulnerability in the email calendar processing component. This flaw allows an unauthenticated attacker to spoof an attendee's response to a meeting by exploiting how Zimbra processes iCalendar REPLY components with a null sender identity. The attacker can change the attendee's participation status in the organizer's calendar without any interaction from the organizer or attendee.
Zimbra Collaboration Suite (ZCS) versions up to 10.1.21 contain an authentication bypass vulnerability in the email calendar processing. This flaw allows an unauthenticated attacker to cancel or modify meetings in a recipient's calendar by sending spoofed iCalendar CANCEL or REQUEST messages. The system does not verify that the sender is authorized as the meeting organizer, enabling unauthorized changes without recipient interaction.
Heimdall versions prior to 0.17.17 improperly validate client IP addresses extracted from Forwarded and X-Forwarded-For headers when the trusted_proxies option is configured. The service accepts arbitrary strings, malformed IP literals, and unknown or obfuscated identifiers without proper syntax validation. Additionally, the Forwarded header parser incorrectly splits quoted strings, potentially causing malformed parsing of client IP addresses. This vulnerability was fixed in version 0.17.17.
CVE-2025-30052 is an authentication bypass vulnerability in the rsyncd service of CGM CLININET. The service grants access based solely on the client's source IP address, allowing an attacker who can spoof an allowed IP to bypass authentication and edit files on the system. Versions up to 2026.MS3 are confirmed affected. A patch is available. The vulnerability has a high severity score of 8.8.
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid, and to force arbitrary orders into a failed state regardless of the gateway's configuration.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
CVE-2026-110723 affects the Eclipse Connected Services Platform's api-gateway component in versions 1.1.1 through 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
FileRise versions prior to 3.23.0 contain an improper authentication vulnerability where the software maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.
FileRise versions prior to 3.16.0 with AUTH_BYPASS enabled are vulnerable to an authentication bypass vulnerability. This occurs because the application trusts the reverse-proxy identity header without verifying the request's origin from trusted proxies. An attacker can exploit this by directly accessing the backend port and supplying the X-Remote-User header to impersonate any user, including administrators, without authentication. The vulnerability is fixed in version 3.16.0.