By weakness (CWE)

CWE-288: related vulnerabilities

CVEs classified under CWE-288. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

17 published vulnerabilities

• CVE-2026-49062HIGH 8.8

  A flaw in WP Engine's Faust.Js framework allows an attacker with login credentials to bypass authentication controls and exploit the password recovery mechanism. An authenticated user can manipulate the password recovery process to gain unauthorized access or escalate privileges, effectively circumventing normal authentication barriers. This is particularly dangerous because the attack requires only basic login access—not admin rights—yet yields full system compromise potential.

• CVE-2026-5415HIGH 8.8

  WP Captcha PRO, a WordPress plugin used for reCAPTCHA integration, contains a critical flaw that allows attackers with basic user access to impersonate any account on the site, including administrators. The vulnerability chains together three separate weaknesses: the plugin exposes a security token to low-privilege users, uses that token in an unprotected function that generates passwordless login links, and then automatically logs in visitors using those links without verifying they should have access. An attacker with even Subscriber-level access (the lowest user role) can exploit this to take over any account and gain full control of the WordPress installation.

• CVE-2026-8697HIGH 8.8

  A vulnerability in TP-Link Archer C64 v1 routers allows attackers on the local network to repeatedly guess administrative passwords without restriction. The device runs a debug SSH service that shares login credentials with the web interface but fails to limit failed authentication attempts. An attacker who gains valid credentials through brute force can take complete control of the router, potentially redirecting traffic, stealing data, or disrupting network connectivity.

• CVE-2026-50194HIGH 8.2

  Steeltoe, an open-source framework for building cloud-native .NET applications, contains a critical flaw in how it validates access to administrative management endpoints when those endpoints are configured to listen on a separate port. Instead of checking the actual network port a request arrives on, the vulnerable versions check only the Host HTTP header—which an attacker can freely manipulate. This means an attacker on the network can bypass port-based access controls and reach sensitive administrative functions that should be restricted. The vulnerability affects Steeltoe versions 3.2.2 through 3.3.0 and version 4.1.0.

• CVE-2026-56243HIGH 8.1

  Capgo versions before 12.128.2 have a security control bypass flaw where the PostgREST/RLS plane accepts plaintext API keys even when the enforce_hashed_api_keys security setting is turned on. An authenticated attacker can send plaintext API keys directly to bypass the organization-level hashed-key enforcement and gain access to protected resources that should require stronger authentication.

• CVE-2020-37255HIGH 7.5

  WordPress Time Capsule Plugin version 1.21.16 contains a critical authentication bypass flaw. An attacker can send a specially crafted web request with a specific header to gain full administrator access to a WordPress site without knowing any password. This allows them to take complete control of the website and its contents.

• CVE-2026-40780HIGH 7.5

  Liquid Web's BookIt plugin contains a flaw in its password recovery mechanism that allows attackers to bypass authentication. Rather than attacking the login process directly, an attacker can exploit an alternate recovery path to gain unauthorized access without needing valid credentials. This affects BookIt versions before 2.5.4.1.

• CVE-2026-42668HIGH 7.5

  The Email Marketing for WooCommerce plugin by Omnisend contains a critical authentication bypass vulnerability affecting versions 1.18.0 and earlier. An unauthenticated attacker can access sensitive email marketing functionality without valid credentials, potentially exposing customer data and campaign information. This vulnerability requires no user interaction and can be exploited remotely by any threat actor with network access to an affected WooCommerce store.

• CVE-2026-42654HIGH 7.1

  WP Swings Wallet System for WooCommerce contains a flaw that allows attackers with an existing user account to bypass normal authentication safeguards and exploit the password recovery mechanism. An authenticated attacker could use this vulnerability to take over other user accounts, including administrative ones, without knowing their passwords. The vulnerability affects all versions up to and including 2.7.5.

• CVE-2026-36028MEDIUM 6.8

  CVE-2026-36028 is a protection mechanism failure in the Code 27 Companion Hub that allows an attacker with physical access to the device to completely bypass kiosk restrictions by performing a factory reset. The vulnerability requires no authentication or user interaction and exposes high-value information and system integrity. The risk is primarily environmental—it only affects devices where physical access can be obtained and where kiosk restrictions are relied upon for security.

• CVE-2026-36175MEDIUM 6.8

  CVE-2026-36175 is a physical authentication bypass vulnerability affecting GNCC GP5 v7.1.76. An attacker with direct physical access to a device can interrupt the boot process and inject malicious kernel boot arguments, circumventing security controls to obtain root-level access. The vulnerability requires the attacker to be present at the device during startup, making it a targeted risk rather than a remote threat.

• CVE-2026-54817MEDIUM 6.5

  FluxBuilder's MStore API contains an authentication bypass vulnerability that can be exploited through alternate paths or channels to compromise password recovery functionality. An attacker can exploit this without authentication to modify data or disrupt service availability. The vulnerability affects MStore API versions up to and including 4.18.4.

• CVE-2026-20459MEDIUM 5.3

  A flaw in cellular modem firmware allows an attacker operating a rogue base station to crash a device's modem, temporarily knocking it offline. The vulnerability requires no special privileges and occurs automatically when a user connects to the attacker's malicious network. It does not lead to data theft or system compromise, but causes service disruption.

• CVE-2026-20460MEDIUM 5.3

  A modem vulnerability allows attackers to remotely extract sensitive information when a user connects to a compromised wireless base station. The flaw stems from improper validation of network input, enabling an attacker controlling a rogue base station to read confidential data without needing any special privileges or user interaction. Exploitation requires the target device to connect to the attacker's malicious network, but once connected, data disclosure occurs automatically.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.

• CVE-2026-58517MEDIUM 4.3

  A flaw in MediaWiki's WikiLambda extension allows authenticated users to bypass intended access controls by improperly handling input terminators. An attacker with login credentials could potentially manipulate their permissions or perform actions beyond their assigned role, though the vulnerability requires authentication and does not lead to data disclosure or system unavailability.

• CVE-2025-13475LOW 3.5

  CVE-2025-13475 is a consent isolation flaw in multi-tenant deployments where user consent granted for a SaaS application in one tenant can leak to applications with the same name in other tenants. This cross-tenant consent sharing allows applications to access user data without proper authorization. The issue is confined to systems running in multi-tenant mode; single-tenant deployments are unaffected.