CWE-304

CWE-304 · 11 records · 3 with a public proof-of-concept

Records the NVD classes under CWE-304, highest CVSS first.

  1. CRITICAL 9.1CVE-2026-940522026-09-30

    A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional ss…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-73535public PoC2026-10-14

    Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain…

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.1CVE-2026-890682026-10-14

    Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    moveit transfer

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 8.1CVE-2026-939942026-09-30

    Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config Authen…

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 7.7CVE-2026-778002026-11-03

    ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 6.8CVE-2026-1232972026-11-06

    In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 6.5CVE-2026-1134382026-10-26

    Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a passw…

    AI risk analysis on Exploit-DB.ai →

  8. MEDIUM 5.3CVE-2026-100667public PoC2026-09-26

    grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::…

    AI risk analysis on Exploit-DB.ai →

  9. UNSCOREDCVE-2026-119776public PoC2026-11-04

    In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable mali…

    AI risk analysis on Exploit-DB.ai →

  10. UNSCOREDCVE-2026-1012962026-10-20

    A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apa…

    AI risk analysis on Exploit-DB.ai →

  11. UNSCOREDCVE-2026-1080712026-10-14

    Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does…

    AI risk analysis on Exploit-DB.ai →