CWE-308

CVEs per yearBy the year they were published

1. 20232
2. 20243
3. 20252
4. 202616

Newest CVEs

• CVE-2026-19868

  An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass…

  SonicWall · SonicOS

  High7.5
• CVE-2026-121531

  Umami 2FA Policy route.ts single-factor authentication

  Umami

  Medium5.3
• CVE-2026-90862

  Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

  Progress Software · WS_FTP Server

  Medium4.3
• CVE-2026-111884

  phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

  thorsten · phpMyFAQ

  High8.7
• CVE-2026-57490

  FileRise: WebDAV authentication bypasses TOTP/MFA entirely

  error311 · FileRise

  High8.1
• CVE-2026-107808

  Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

  0xJacky · nginx-ui

  High8.1
• CVE-2026-79763

  Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

  Termix-SSH · Termix

  Medium5.3
• CVE-2026-58240

  Missing Authentication check in SAP NetWeaver (Message Server)

  SAP_SE · SAP NetWeaver (Message Server)

  Critical9.8
• CVE-2026-85590

  phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable

  thorsten · phpMyFAQ

  High7.1
• CVE-2026-67611

  OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

  openemr · openemr

  High8.6

Vendors it comes up for most

1. IBM2
2. SAP_SE2
3. Termix-SSH2
4. thorsten2
5. 0xJacky1
6. Alinto1
7. JetBrains1
8. Logto1
9. Progress Software1
10. Shilpi Computers1