Vulnerabilities
HAProxy Data Plane API Critical Auth Bypass CVE-2026-109575 Fixed
A critical flaw in HAProxy Data Plane API allows unauthenticated access to administrative controls when specific TLS settings are active.
authentication bypass
Everything Threat Times has reported about authentication bypass: 21 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
PraisonAI Fixes Critical Auth Bypass in Agent Teams Before 1.6.59
Unauthenticated users could exploit missing access controls in PraisonAI to enumerate agents and trigger workflows remotely.
Vulnerabilities
Neo4j GraphQL Library Fixes Critical Authentication Bypass in Version 7.6.4
A critical flaw in Neo4j’s GraphQL library allowed unauthenticated users to execute Cypher queries, a vulnerability now patched in version 7.6.4.
Vulnerabilities
Thirty bees 1.7.0 authentication bypass allows guest account takeover
A critical flaw in Thirty bees enables attackers to reset customer passwords using guest checkout tokens, affecting versions through 1.7.0.
Vulnerabilities
OTRS Critical Flaw Lets Attacker Use Valid Tokens After Account Deactivation
A critical vulnerability in OTRS allows attackers to maintain access using valid JWTs even after user accounts are deactivated or passwords changed.
Vulnerabilities
OTRS Community Edition 6 Has Critical Authentication Bypass Vulnerability
A critical flaw in OTRS Community Edition 6 allows remote attackers to bypass authentication and impersonate users without valid credentials.
Vulnerabilities
BotSharp 5.2.0 has critical auth bypass via hardcoded JWT key
An unauthenticated remote attacker can forge bearer tokens in BotSharp through version 5.2.0 using a hardcoded secret in the WebStarter configuration file.
Vulnerabilities
Wukong_HRM Authentication Bypass Grants Admin Access Without Token
A critical flaw in Wukong_HRM allows unauthenticated attackers to bypass security controls and manipulate sensitive HR data.
Vulnerabilities
WPCOM Member Plugin Critical Auth Bypass Lets Attackers Hijack Admin Accounts
A critical authentication bypass in the WPCOM Member WordPress plugin allows unauthenticated attackers to log in as any user, including administrators, through session forgery.
Vulnerabilities
Critical Auth Bypass in WordPress Advanced IP Blocker Plugin Allows Unauthenticated Access
A flaw in the Advanced IP Blocker plugin lets attackers bypass passwords and 2FA to take over WordPress sites using known user IDs.
Vulnerabilities
SonicWall and Splunk Patch Critical and High-Severity Vulnerabilities
SonicWall and Splunk have released patches for critical and high-severity flaws that allow authentication bypasses and arbitrary code execution.
Vulnerabilities
Nginx UI Exposes Master Credentials in URL Logs, Allowing Full Admin Bypass
A flaw in Nginx UI versions 2.0.0 through 2.5.0 exposes the master node secret in HTTP logs and URLs, enabling attackers to bypass authentication and gain persistent administrative access.
Vulnerabilities
Nginx UI Passkey Bypass Lets Attackers Bypass 2FA in Versions Before 2.5.0
A flaw in Nginx UI allows password-only login for passkey-protected accounts, bypassing second-factor authentication in versions prior to 2.5.0.
Vulnerabilities
Nginx UI Auth Bypass Lets Low-Priv Users Impersonate Trusted Cluster Nodes
A high-severity flaw in Nginx UI allows authenticated users to steal node tokens and bypass cluster authentication, exposing management operations.
Vulnerabilities
Nginx UI cluster operations bypass OTP step-up in incomplete CVE-2026-107813 fix
An incomplete security patch in Nginx UI allows attackers with a stolen JWT to manage cluster nodes and restart servers without secondary authentication.
Vulnerabilities
FalkorDB Bolt Endpoint Auth Bypass Lets Attackers Run Queries Without Credentials
A critical flaw in FalkorDB before 4.20.0 allows unauthenticated remote attackers to execute graph queries via the Bolt protocol if specific Redis errors occur.
Vulnerabilities
IBM Security Verify Access Critical Authentication Bypass Vulnerability Exposed
A critical flaw in IBM identity management software allows remote attackers to bypass authentication controls in multiple product versions.
Vulnerabilities
IBM Identity Products Face Critical Authentication Bypass Vulnerability CVE-2026-16823
A critical flaw in IBM Security Verify Access and Verify Identity Access allows remote attackers to bypass security restrictions due to improper authentication.
Vulnerabilities
HPE iMC Authentication Bypass Vulnerability Rated Critical by NVD
The National Vulnerability Database rates an authentication bypass flaw in HPE Intelligent Management Center as critical, affecting versions prior to 7.3 E0713.
Vulnerabilities
Critical IBM DataPower Gateway Flaw Allows Remote Admin Access via Empty LDAP Passwords
IBM DataPower Gateway versions 10.5 through 11.0 contain a critical authentication bypass flaw that lets attackers gain administrative control by submitting empty passwords.
Vulnerabilities
Critical Auth Bypass in Integrics Enswitch Allows Password Takeover
Unauthenticated attackers can reset admin passwords in Integrics Enswitch versions up to 4.4 by exploiting a logic flaw in the password update API endpoint.