CWE-287: Improper authentication
5,342 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 51 of them as exploited in the wild.
- Published CVEs
- 5,342
- Last 12 months
- 1,408
- Critical
- 1,389
- Known exploited
- 51
Critical 1,389High 1,996Medium 1,822Low 133Not scored 2
CVEs per yearBy the year they were published
- 201533
- 201651
- 2017232
- 2018301
- 2019274
- 2020351
- 2021302
- 2022417
- 2023387
- 2024327
- 2025359
- 20261,368
Known exploitedNewest addition to KEV first
- CVE-2024-27834
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5,…
Apple · Safari
ExploitedMedium5.5 - CVE-2026-105133
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
Ahsay · AhsayCBS
ExploitedMedium6.9 - CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactory
jfrog · artifactory
ExploitedHigh7.5 - CVE-2026-82329
Potential authentication bypass leading to administrative access in Artifactory
jfrog · artifactory
ExploitedCritical9.8 - CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
BerriAI · litellm
ExploitedHigh8.8 - CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0 - CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of…
Product not named
ExploitedCritical9.8 - CVE-2026-65400
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9,…
Apple · macOS
ExploitedCritical9.8 - CVE-2026-16232
Authentication Bypass in the SmartConsole Login Process Using an Application Token
checkpoint · Quantum Security Management
ExploitedCritical9.3 - CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are…
Oracle Corporation · Oracle Payments
ExploitedCritical9.8
Newest CVEs
- CVE-2026-123963
OpenBMB Internet of Agents Agent Registry app.py register missing authentication
OpenBMB · Internet of Agents
Medium6.9 - CVE-2026-104014
Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization
naimurrahmannahid · Naimur Email OTP Verification for WooCommerce
Critical9.8 - CVE-2026-118066
Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
latepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Critical9.1 - CVE-2026-17370
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium6.4 - CVE-2026-17358
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.2 - CVE-2026-17326
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.1 - CVE-2026-17240
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium6.5 - CVE-2026-17158
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.9 - CVE-2026-16720
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.8 - CVE-2026-59104
UgCS server HCI authentication bypass with empty credentials
SPH Engineering · UgCS
Critical9.3