CVE-2026-57775
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile all
CVSS
5.3
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 4, 2026 · Last modified: Nov 4, 2026 · CWE-288
Not enough EPSS history yet.
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-52848——
———GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.5hCVE-2026-1042037.5 HIG—
———Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.7hCVE-2026-551864.2 MED—
——0Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.1dCVE-2026-777997.4 HIG67.6%
——20ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.14hCVE-2026-71450—20.9%
——6Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.
This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.1dCVE-2026-116606—54.2%
——16An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.2d