#authentication-bypass

Critical Nginx UI Flaw Enables Server Takeover Without Auth

A critical vulnerability in Nginx UI with Model Context Protocol support allows attackers to gain full server control without authentication.

CVE-2026-33032: Critical nginx-ui Flaw Under Active Attack

A critical authentication bypass vulnerability in nginx-ui enables attackers to seize control of Nginx services through active exploitation campaigns.

Fortinet Patches Critical FortiSandbox RCE Flaws

Fortinet released emergency patches for critical FortiSandbox vulnerabilities allowing authentication bypass and remote code execution via HTTP requests.

Progress ShareFile RCE Flaws Enable Pre-Auth Server Takeover

Critical Progress ShareFile vulnerabilities allow attackers to chain exploits for unauthenticated remote code execution and arbitrary file uploads.

Cisco Patches Critical IMC Authentication Bypass Flaw

Cisco fixed multiple critical vulnerabilities including an authentication bypass in Integrated Management Controller granting admin access.

TP-Link Patches Critical Router Flaws Enabling RCE

TP-Link released security updates fixing high-severity vulnerabilities that allow authentication bypass and remote code execution on popular router models.

HPE AOS-CX Flaw Lets Attackers Reset Admin Passwords

Critical HPE AOS-CX vulnerability enables remote attackers to bypass authentication and reset administrator passwords without credentials.

HPE Patches Five Critical AOS-CX Flaws: RCE, Privilege Escalation and Session Hijacking

HPE released emergency patches on March 10, 2026 for five critical and high-severity vulnerabilities in Aruba Networking AOS-CX, including two command injection flaws enabling remote code execution, an SSH privilege escalation, a web session hijacking bug, and a port ACL bypass on CX 9300 switches. Immediate patching is required for all enterprise Aruba CX deployments.

WordPress Plugin Bug Lets Hackers Create Admin Accounts

Critical flaw in User Registration plugin affects 60,000+ WordPress sites, enabling unauthorized admin account creation.