CWE-288 vulnerabilities

CVE-2026-18574 is a critical authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS). It allows an unauthenticated remote attacker with network access to management services to execute arbitrary commands on the Security Management Server, potentially leading to full system compromise. The issue was discovered internally by Check Point with no indication of active exploitation.

CVE-2026-33591 is a critical authentication bypass vulnerability in Tranquil IT Systems WAPT Server versions 2.6.0.16767 through 2.6.1.17787. It allows a remote unauthenticated attacker to bypass security restrictions by sending a specially crafted packet, enabling retrieval of a valid session token for a targeted account.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configuration, and network settings, which could allow disruption of connected infrastructure or physical damage to equipment.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

FUXA versions 1.2.11 through 1.3.0 contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code as root. This vulnerability persists even when the software is configured with its most secure settings enabled. The issue is resolved in version 1.3.1.

Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.

NVIDIA Triton Inference Server for Linux has a vulnerability (CWE-288) that allows an attacker to bypass authentication using an alternate path or channel. Exploiting this flaw could lead to limited confidentiality and integrity impacts, including potential code execution, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.5 (medium severity). No patch or official remediation is currently confirmed.

Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.