CWE-636 · 61 records

Not Failing Securely ('Failing Open')

CVEs in this class

61 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-43532No exploit	Remote Registry Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-636	High8.8	—	11.9%	Oct 8, 2024
39Monitor	CVE-2024-3729No exploit	Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulationdynamiapps · frontend admin · CWE-636 Pre-auth Auth bypass	Critical9.8	—	0.8%	May 2, 2024
38Monitor	CVE-2026-103510No exploit	Authentication bypass via blank auth token in P4Searchperforce · p4 (helix core) · CWE-636 Pre-auth Auth bypass	Critical9.5	—	0.3%	Oct 5, 2026
37Monitor	CVE-2026-53459No exploit	Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpointsmaziggy · bambuddy · CWE-636 Pre-auth Auth bypass	Critical9.3	—	0.7%	Sep 15, 2026
37Monitor	CVE-2026-95848No exploit	Moquette fails open when configured authentication or authorization classes cannot loadmoquette · moquette · CWE-636 Pre-auth	Critical9.3	—	0.4%	Sep 23, 2026
36Monitor	CVE-2021-1578No exploit	Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerabilitycisco · application policy infrastructure controller · CWE-636	High8.8	—	1.9%	Aug 25, 2021
36Monitor	CVE-2026-22034No exploit	Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD packagejvoisin · snuffleupagus · CWE-636 pre-auth RCE	Critical9.2	—	0.7%	Jan 8, 2026
36Monitor	CVE-2026-40525No exploit	OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPIvolcengine · openviking · CWE-636 Pre-auth Auth bypass	Critical9.1	—	0.5%	Apr 17, 2026
36Monitor	CVE-2026-109593No exploit	An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potesonicwall · global management system (gms) · CWE-636 Pre-auth	Critical9.1	—	0.5%	2 days ago
36Monitor	CVE-2026-77866No exploit	SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hostsslab · safeurl · CWE-636 Pre-auth SSRF	Critical9.0	—	0.4%	Sep 15, 2026
36Monitor	CVE-2026-70452No exploit	rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failurersyncproject · rsync · CWE-636 Pre-auth	Critical9.1	—	0.4%	Aug 13, 2026
36Monitor	CVE-2026-108142No exploit	A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.veeam · backup and replication · CWE-636 Pre-auth	Critical9.1	—	0.4%	Oct 27, 2026
35Monitor	CVE-2026-18329No exploit	NGINX ngx_http_js_module vulnerabilityf5 · nginx javascript · CWE-636 Pre-auth	High8.8	—	0.6%	Sep 2, 2026
34Monitor	CVE-2025-54870No exploit	VTun-ng's failure to initialize encryption modules may cause reversion to plaintextleakingmemory · vtun-ng · CWE-636 Pre-auth	High8.7	—	0.2%	Aug 4, 2025
33Monitor	CVE-2026-44094No exploit	Fallback to second RAUC slot with default credentialsphoenix contact · charx sec-3150 · CWE-636 Pre-auth Hard-coded credentials	High8.3	—	0.4%	Jul 30, 2026
33Monitor	CVE-2026-35205No exploit	Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin installhelm · helm · CWE-636	High8.4	—	0.2%	Apr 9, 2026
32Monitor	CVE-2026-69306No exploit	Visual Studio Code Security Feature Bypass Vulnerabilitymicrosoft · visual studio code · CWE-636 Pre-auth	High8.2	—	0.5%	Aug 11, 2026
32Monitor	CVE-2026-81379No exploit	Visual Studio Code Security Feature Bypass Vulnerabilitymicrosoft · visual studio code · CWE-636 Pre-auth	High8.2	—	0.5%	Sep 8, 2026
32Monitor	CVE-2026-92591No exploit	Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installercraftcms · cms · CWE-636 Pre-auth CSRF	High8.2	—	0.4%	Sep 16, 2026
32Monitor	CVE-2026-53712No exploit	SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithmsongres · scram · CWE-636 Pre-auth	High8.2	—	0.2%	Jul 17, 2026
32Monitor	CVE-2026-54291No exploit	Silent channel-binding authentication downgrade via unsupported certificate algorithmspostgresql · postgresql jdbc driver · CWE-636 Pre-auth	High8.2	—	0.2%	Jul 6, 2026
32Monitor	CVE-2026-78022No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerabilidell · policy manager for secure connect gateway · CWE-636	High8.1	—	0.1%	Oct 9, 2026
31Monitor	CVE-2023-4030No exploit	A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover tolenovo · thinkpad t15 gen 2 firmware · CWE-636	High7.8	—	0.1%	Aug 17, 2023
30Monitor	CVE-2023-45285No exploit	Command 'go get' may unexpectedly fallback to insecure git in cmd/gogolang · go · CWE-636 Pre-auth	High7.5	—	1.1%	Dec 6, 2023
30Monitor	CVE-2026-68746No exploit	Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated accesslivebook · livebook · CWE-636 Auth bypass	High7.7	—	0.8%	Aug 5, 2026

CVE-2024-43532
39Monitor
Remote Registry Service Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 11%
microsoft · windows 10 1507Oct 8, 2024
CVE-2024-3729
39Monitor
Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
dynamiapps · frontend adminMay 2, 2024
CVE-2026-103510
38Monitor
Authentication bypass via blank auth token in P4Search
CriticalCVSS 9.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
perforce · p4 (helix core)Oct 5, 2026
CVE-2026-53459
37Monitor
Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
maziggy · bambuddySep 15, 2026
CVE-2026-95848
37Monitor
Moquette fails open when configured authentication or authorization classes cannot load
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
moquette · moquetteSep 23, 2026
CVE-2021-1578
36Monitor
Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
HighCVSS 8.8No exploitEPSS 1%
cisco · application policy infrastructure controllerAug 25, 2021
CVE-2026-22034
36Monitor
Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
jvoisin · snuffleupagusJan 8, 2026
CVE-2026-40525
36Monitor
OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
volcengine · openvikingApr 17, 2026
CVE-2026-109593
36Monitor
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, pote
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
sonicwall · global management system (gms)2 days ago
CVE-2026-77866
36Monitor
SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- SSRF
slab · safeurlSep 15, 2026
CVE-2026-70452
36Monitor
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
rsyncproject · rsyncAug 13, 2026
CVE-2026-108142
36Monitor
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
veeam · backup and replicationOct 27, 2026
CVE-2026-18329
35Monitor
NGINX ngx_http_js_module vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
f5 · nginx javascriptSep 2, 2026
CVE-2025-54870
34Monitor
VTun-ng's failure to initialize encryption modules may cause reversion to plaintext
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
leakingmemory · vtun-ngAug 4, 2025
CVE-2026-44094
33Monitor
Fallback to second RAUC slot with default credentials
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
phoenix contact · charx sec-3150Jul 30, 2026
CVE-2026-35205
33Monitor
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
HighCVSS 8.4No exploitEPSS 0%
helm · helmApr 9, 2026
CVE-2026-69306
32Monitor
Visual Studio Code Security Feature Bypass Vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
microsoft · visual studio codeAug 11, 2026
CVE-2026-81379
32Monitor
Visual Studio Code Security Feature Bypass Vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
microsoft · visual studio codeSep 8, 2026
CVE-2026-92591
32Monitor
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- CSRF
craftcms · cmsSep 16, 2026
CVE-2026-53712
32Monitor
SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
ongres · scramJul 17, 2026
CVE-2026-54291
32Monitor
Silent channel-binding authentication downgrade via unsupported certificate algorithms
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
postgresql · postgresql jdbc driverJul 6, 2026
CVE-2026-78022
32Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerabili
HighCVSS 8.1No exploitEPSS 0%
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2023-4030
31Monitor
A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to
HighCVSS 7.8No exploitEPSS 0%
lenovo · thinkpad t15 gen 2 firmwareAug 17, 2023
CVE-2023-45285
30Monitor
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
golang · goDec 6, 2023
CVE-2026-68746
30Monitor
Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
livebook · livebookAug 5, 2026

All vulnerability classes