CWE-288
747 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 20 of them as exploited in the wild.
- Published CVEs
- 747
- Last 12 months
- 345
- Critical
- 284
- Known exploited
- 20
Critical 284High 272Medium 176Low 13Not scored 2
CVEs per yearBy the year they were published
- 20173
- 20186
- 201910
- 202014
- 202115
- 202235
- 202351
- 2024116
- 2025171
- 2026326
Known exploitedNewest addition to KEV first
- CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
NetScaler · ADC
ExploitedCritical9.3 - CVE-2026-20079
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedCritical10.0 - CVE-2026-18556
Unauthenticated administrative account takeover
N-able · N-central
ExploitedHigh8.2 - CVE-2026-18577
Incomplete patch leads to administrative account takeover
N-able · N-central
ExploitedHigh8.2 - CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Ivanti · Endpoint Manager
ExploitedHigh8.6 - CVE-2026-24858
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…
Fortinet · FortiWeb
ExploitedCritical9.4 - CVE-2026-23760
SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
SmarterTools · SmarterMail
ExploitedCritical9.3 - CVE-2025-34026
Versa Concerto Actuator Authentication Bypass Information Leak
Versa · Concerto
ExploitedCritical9.2 - CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8 - CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
Kentico · Xperience
ExploitedCritical9.8
Newest CVEs
- CVE-2026-76052
The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher
IBM · Storage Scale System
Medium6.0 - CVE-2026-119498
WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability
RelyWP · Simple Cloudflare Turnstile
Medium5.3 - CVE-2026-17313
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.8 - CVE-2026-123618
ABP Framework before 10.7.1 Authentication Bypass via External Login Provider
abpframework · abp
High7.6 - CVE-2026-123746
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
sensiolabs · symfony
Low2.3 - CVE-2026-49393
OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
tinyhumansai · openhuman
High8.4 - CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-52848
GLPI: MFA bypass
glpi-project · glpi
Critical9.2 - CVE-2026-104203
Traccar: Authentication bypass via path parameters exposes protected device media
traccar · traccar
High7.5