CWE-289

Records the NVD classes under CWE-289, highest CVSS first.

1. CRITICAL 9.8CVE-2026-761832026-09-23

   Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M…

   AI risk analysis on Exploit-DB.ai →

2. HIGH 7.4CVE-2026-100351public PoC2026-10-15

   kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a diffe…

   AI risk analysis on Exploit-DB.ai →

3. MEDIUM 6.8CVE-2026-57176public PoC2026-09-24

   Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from diff…

   AI risk analysis on Exploit-DB.ai →

4. MEDIUM 5.3CVE-2026-955142026-09-23

   Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

   AI risk analysis on Exploit-DB.ai →

5. MEDIUM 5.3CVE-2026-73511public PoC2026-09-21

   Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters fro…

   AI risk analysis on Exploit-DB.ai →

6. UNSCOREDCVE-2026-104143public PoC2026-10-14

   DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used…

   AI risk analysis on Exploit-DB.ai →