CWE-288 vulnerabilities

CVE-2026-74001 is a critical authentication bypass vulnerability in WPEverest User Registration & Membership Pro versions up to 5.4.5. It allows unauthenticated attackers to bypass authentication mechanisms using an alternate path or channel. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-66677 is a high-severity authentication bypass vulnerability in VaultDweller's Leyka product affecting versions up to 3.32.3. It involves broken authentication that allows bypassing using an alternate path or channel. The vulnerability has a CVSS 3.1 score of 7.6, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided.

4gaBoards versions prior to 3.3.8 have an improper authentication vulnerability that allows attackers to create unverified local accounts using a victim's email when multiple registration methods and SSO providers are enabled. This flaw enables attackers to link their local account to the victim's verified SSO identity without ownership verification, retaining password access and gaining unauthorized access to the victim's projects and data. The issue is resolved in version 3.3.8.

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

CVE-2026-75045 is a critical vulnerability in JetBrains YouTrack before version 2025.3.156085. It allows an unauthenticated attacker to download database backups by exploiting a shared draft signature mechanism. This vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring authentication or user interaction. The issue is fixed starting from version 2025.3.156085.

Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.

CVE-2026-66451 is an authentication bypass vulnerability affecting WP Event SOlution versions up to and including 4.1.9. This flaw allows unauthenticated attackers to bypass authentication mechanisms, potentially leading to limited confidentiality and integrity impacts. The vulnerability is classified under CWE-288, indicating broken authentication via an alternate path or channel. The CVSS 3.1 base score is 6.5, reflecting a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild at this time.

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.

CVE-2026-65542 is a high severity authentication bypass vulnerability affecting Super Socializer versions up to and including 7.14.5. The flaw involves unauthenticated broken authentication due to an alternate path or channel, classified under CWE-288. This vulnerability allows attackers to bypass authentication mechanisms potentially leading to full compromise of confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the publication date. There are no known exploits in the wild currently reported.

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

CVE-2026-58073 is a critical authentication bypass vulnerability in Veeam Service Provider Console. It allows an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials. The vulnerability is classified under CWE-288, indicating an authentication bypass using an alternate path or channel. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.