CWE-288
736 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 20 of them as exploited in the wild.
- Published CVEs
- 736
- Last 12 months
- 337
- Critical
- 281
- Known exploited
- 20
Critical 281High 269Medium 170Low 12Not scored 4
CVEs per yearBy the year they were published
- 20173
- 20186
- 201910
- 202014
- 202115
- 202235
- 202351
- 2024116
- 2025171
- 2026315
Known exploitedNewest addition to KEV first
- CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
NetScaler · ADC
ExploitedCritical9.3 - CVE-2026-20079
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedCritical10.0 - CVE-2026-18556
Unauthenticated administrative account takeover
N-able · N-central
ExploitedHigh8.2 - CVE-2026-18577
Incomplete patch leads to administrative account takeover
N-able · N-central
ExploitedHigh8.2 - CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Ivanti · Endpoint Manager
ExploitedHigh8.6 - CVE-2026-24858
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…
Fortinet · FortiWeb
ExploitedCritical9.4 - CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
SmarterTools · SmarterMail
ExploitedCritical9.3 - CVE-2025-34026
Versa Concerto Actuator Authentication Bypass Information Leak
Versa · Concerto
ExploitedCritical9.2 - CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8
Newest CVEs
- CVE-2026-52848
GLPI: MFA bypass
glpi-project · glpi
Critical9.2 - CVE-2026-104203
Traccar: Authentication bypass via path parameters exposes protected device media
traccar · traccar
High7.5 - CVE-2026-57775
WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability
RelyWP · Simple Cloudflare Turnstile
Medium5.3 - CVE-2026-55186
Silverstripe MFA: Can bypass MFA during password reset flow
silverstripe · silverstripe-mfa
Medium4.2 - CVE-2026-77799
Two-factor authentication bypass
Zohocorp · ManageEngine Key Manager Plus
High7.4 - CVE-2026-71450
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.…
Johnson Controls · EasyIO Neo EC and CW Edge Controller
High8.7 - CVE-2026-116606
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
Barracuda Networks · Barracuda Email Security Gateway (ESG)
Critical9.3 - CVE-2026-115829
Secret Server partial login bypass
Delinea · Secret Server
High8.7 - CVE-2026-119420
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
getlago · lago
High8.7 - CVE-2026-107254
Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
Drupal · Authenticator Login Plus (2FA)
Medium4.8