CWE-1390 · 105 records
Weak Authentication
CVEs in this class
105 records
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
87Now | CVE-2026-55040Weaponized | Microsoft SharePoint Server Security Feature Bypass Vulnerabilitymicrosoft · sharepoint server · CWE-1390 | Critical9.1 | KEV | 69.5% | Jul 14, 2026 |
57Plan | CVE-2025-40554Proof of concept | SolarWinds Web Help Desk Authentication Bypass Vulnerabilitysolarwinds · web help desk · CWE-1390 | Critical9.8 | — | 60.6% | Jan 28, 2026 |
55Plan | CVE-2025-40552Proof of concept | SolarWinds Web Help Desk Authentication Bypass Vulnerabilitysolarwinds · web help desk · CWE-1390 | Critical9.8 | — | 51.9% | Jan 28, 2026 |
40Plan | CVE-2025-30411No exploit | Sensitive data disclosure and manipulation due to improper authentication.acronis · cyber protect · CWE-1390 | Critical10.0 | — | 0.7% | Feb 19, 2026 |
40Plan | CVE-2025-30412No exploit | Sensitive data disclosure and manipulation due to improper authentication.acronis · cyber protect · CWE-1390 | Critical10.0 | — | 0.6% | Feb 19, 2026 |
39Monitor | CVE-2022-43400No exploit | A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)).siemens · siveillance video mobile server · CWE-1390 | Critical9.8 | — | 1.0% | Oct 21, 2022 |
39Monitor | CVE-2026-65098No exploit | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.nvidia · nemoclaw · CWE-1390 | Critical9.8 | — | 0.9% | Aug 25, 2026 |
39Monitor | CVE-2026-73025No exploit | Windows iSCSI Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1607 · CWE-1390 | Critical9.8 | — | 0.9% | Sep 8, 2026 |
39Monitor | CVE-2024-38182No exploit | Microsoft Dynamics 365 Elevation of Privilege Vulnerabilitymicrosoft · dynamics 365 · CWE-1390 | Critical9.8 | — | 0.8% | Jul 31, 2024 |
39Monitor | CVE-2025-39596Proof of concept | WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerabilityquentn.com gmbh · quentn wp · CWE-1390 | Critical9.8 | — | 0.5% | Apr 17, 2025 |
39Monitor | CVE-2025-1387No exploit | Learning Digital Orca HCM - Improper Authenticationlearningdigital · orca hcm · CWE-1390 | Critical9.8 | — | 0.5% | Feb 17, 2025 |
39Monitor | CVE-2025-49201No exploit | A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all vefortinet · fortipam · CWE-1390 | Critical9.8 | — | 0.5% | Oct 14, 2025 |
39Monitor | CVE-2024-13239No exploit | Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003two-factor authentication project · two-factor authentication · CWE-1390 | Critical9.8 | — | 0.5% | Jan 9, 2025 |
39Monitor | CVE-2024-50563No exploit | A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud vfortinet · fortianalyzer · CWE-1390 | Critical9.8 | — | 0.5% | Jan 16, 2025 |
39Monitor | CVE-2024-48886No exploit | A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, Forfortinet · fortianalyzer · CWE-1390 | Critical9.8 | — | 0.4% | Jan 14, 2025 |
39Monitor | CVE-2026-28710No exploit | Sensitive information disclosure and manipulation due to improper authentication.acronis · cyber protect · CWE-1390 | Critical9.8 | — | 0.4% | Mar 5, 2026 |
39Monitor | CVE-2025-47479No exploit | WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerabilitywpcompress · wp compress · CWE-1390 | Critical9.8 | — | 0.3% | Jul 4, 2025 |
37Monitor | CVE-2024-54092No exploit | A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (Alsiemens · industrial edge device kit - arm64 v1.17 · CWE-1390 | Critical9.3 | — | 0.7% | Apr 8, 2025 |
37Monitor | CVE-2025-12870No exploit | aEnrich｜eHRD - Authentication Abuseaenrich · a+hrd · CWE-1390 | Critical9.3 | — | 0.6% | Nov 12, 2025 |
37Monitor | CVE-2023-53894No exploit | phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerabilitydulldusk · phpfilemanager · CWE-1390 | Critical9.3 | — | 0.6% | Dec 16, 2025 |
37Monitor | CVE-2025-12871No exploit | aEnrich｜a+HRD - Authentication Abuseaenrich · a+hrd · CWE-1390 | Critical9.3 | — | 0.6% | Nov 12, 2025 |
37Monitor | CVE-2026-73819No exploit | Ebyte NA111-M Weak Authenticationebyte · ebyte na111-m firmware · CWE-1390 | Critical9.3 | — | 0.5% | Aug 31, 2026 |
37Monitor | CVE-2026-68067No exploit | Mira Hormone Monitor, Mira Android App Weak Authenticationquanovate tech inc. (operating as mira / mira care) · mira firmware · CWE-1390 | Critical9.3 | — | 0.5% | Aug 11, 2026 |
37Monitor | CVE-2024-45367No exploit | Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authenticationoptigo networks · ons-s8 spectra aggregation switch · CWE-1390 | Critical9.3 | — | 0.5% | Oct 3, 2024 |
37Monitor | CVE-2026-110475No exploit | Improper Authentication Vulnerability in CreditNirvana Collections Platformcreditnirvana · creditnirvana collections platform (collectionworkz) · CWE-1390 | Critical9.3 | — | 0.4% | Oct 26, 2026 |
- CVE-2026-5504087Now
Microsoft SharePoint Server Security Feature Bypass Vulnerability
CriticalCVSS 9.1KEVWeaponizedEPSS 69%microsoft · sharepoint serverJul 14, 2026
- CVE-2025-4055457Plan
SolarWinds Web Help Desk Authentication Bypass Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 60%solarwinds · web help deskJan 28, 2026
- CVE-2025-4055255Plan
SolarWinds Web Help Desk Authentication Bypass Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 51%solarwinds · web help deskJan 28, 2026
- CVE-2025-3041140Plan
Sensitive data disclosure and manipulation due to improper authentication.
CriticalCVSS 10.0No exploitEPSS 0%acronis · cyber protectFeb 19, 2026
- CVE-2025-3041240Plan
Sensitive data disclosure and manipulation due to improper authentication.
CriticalCVSS 10.0No exploitEPSS 0%acronis · cyber protectFeb 19, 2026
- CVE-2022-4340039Monitor
A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)).
CriticalCVSS 9.8No exploitEPSS 1%siemens · siveillance video mobile serverOct 21, 2022
- CVE-2026-6509839Monitor
NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.
CriticalCVSS 9.8No exploitEPSS 0%nvidia · nemoclawAug 25, 2026
- CVE-2026-7302539Monitor
Windows iSCSI Security Feature Bypass Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%microsoft · windows 10 1607Sep 8, 2026
- CVE-2024-3818239Monitor
Microsoft Dynamics 365 Elevation of Privilege Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%microsoft · dynamics 365Jul 31, 2024
- CVE-2025-3959639Monitor
WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%quentn.com gmbh · quentn wpApr 17, 2025
- CVE-2025-138739Monitor
Learning Digital Orca HCM - Improper Authentication
CriticalCVSS 9.8No exploitEPSS 0%learningdigital · orca hcmFeb 17, 2025
- CVE-2025-4920139Monitor
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all ve
CriticalCVSS 9.8No exploitEPSS 0%fortinet · fortipamOct 14, 2025
- CVE-2024-1323939Monitor
Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
CriticalCVSS 9.8No exploitEPSS 0%two-factor authentication project · two-factor authenticationJan 9, 2025
- CVE-2024-5056339Monitor
A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud v
CriticalCVSS 9.8No exploitEPSS 0%fortinet · fortianalyzerJan 16, 2025
- CVE-2024-4888639Monitor
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, For
CriticalCVSS 9.8No exploitEPSS 0%fortinet · fortianalyzerJan 14, 2025
- CVE-2026-2871039Monitor
Sensitive information disclosure and manipulation due to improper authentication.
CriticalCVSS 9.8No exploitEPSS 0%acronis · cyber protectMar 5, 2026
- CVE-2025-4747939Monitor
WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%wpcompress · wp compressJul 4, 2025
- CVE-2024-5409237Monitor
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (Al
CriticalCVSS 9.3No exploitEPSS 0%siemens · industrial edge device kit - arm64 v1.17Apr 8, 2025
- CVE-2025-1287037Monitor
aEnrich｜eHRD - Authentication Abuse
CriticalCVSS 9.3No exploitEPSS 0%aenrich · a+hrdNov 12, 2025
- CVE-2023-5389437Monitor
phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability
CriticalCVSS 9.3No exploitEPSS 0%dulldusk · phpfilemanagerDec 16, 2025
- CVE-2025-1287137Monitor
aEnrich｜a+HRD - Authentication Abuse
CriticalCVSS 9.3No exploitEPSS 0%aenrich · a+hrdNov 12, 2025
- CVE-2026-7381937Monitor
Ebyte NA111-M Weak Authentication
CriticalCVSS 9.3No exploitEPSS 0%ebyte · ebyte na111-m firmwareAug 31, 2026
- CVE-2026-6806737Monitor
Mira Hormone Monitor, Mira Android App Weak Authentication
CriticalCVSS 9.3No exploitEPSS 0%quanovate tech inc. (operating as mira / mira care) · mira firmwareAug 11, 2026
- CVE-2024-4536737Monitor
Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication
CriticalCVSS 9.3No exploitEPSS 0%optigo networks · ons-s8 spectra aggregation switchOct 3, 2024
- CVE-2026-11047537Monitor
Improper Authentication Vulnerability in CreditNirvana Collections Platform
CriticalCVSS 9.3No exploitEPSS 0%creditnirvana · creditnirvana collections platform (collectionworkz)Oct 26, 2026