CWE-305
179 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 179
- Last 12 months
- 68
- Critical
- 55
- Known exploited
- 3
Critical 55High 61Medium 58Low 5Not scored 0
CVEs per yearBy the year they were published
- 20195
- 20206
- 20216
- 202213
- 202319
- 202430
- 202537
- 202663
Known exploitedNewest addition to KEV first
- CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
PaperCut · PaperCut MF/NG
ExploitedHigh8.8 - CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-37085
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an…
VMware ESXi
ExploitedMedium6.8
Newest CVEs
- CVE-2026-112208
Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login
Red Hat · Red Hat Build of Keycloak
High8.1 - CVE-2026-114230
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Apache Software Foundation · Apache Qpid Proton C
Critical9.8 - CVE-2026-10537
Remote unauthenticated information disclosure and denial of service due to unauthenticated service access
BMC · Control-M/Enterprise Manager
Medium6.9 - CVE-2026-110883
WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability
VideoWhisper.com · 2Way VideoCalls and Random Chat
Medium6.5 - CVE-2026-111283
BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
BMC Helix · BMC Helix Network Management
Critical9.5 - CVE-2026-107808
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
0xJacky · nginx-ui
High8.1 - CVE-2026-103059
Gitea built-in SSH server authentication bypass through key case folding
Gitea · Gitea
Critical9.1 - CVE-2026-77185
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
Apache Software Foundation · Apache MINA SSHD
Critical9.1 - CVE-2026-94053
Apache MINA SSHD: LDAP injection in sshd-ldap
Apache Software Foundation · Apache MINA SSHD
Critical9.1 - CVE-2026-59563
HMAC Confirmation Token Unbinding in zscaler-mcp-server
Zscaler · zscaler-mcp-server
Medium4.6