CVE-2026-77799
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid cre
CVSS
7.4
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-288
Not enough EPSS history yet.
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-551864.2 MED—
———Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.5hCVE-2026-71450——
——0Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass.
This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.12hCVE-2026-116606——
——0An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.23hCVE-2026-115829—24.1%
——7In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.2dCVE-2026-1194208.8 HIG33.6%
——10Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.4dCVE-2026-118582—7.8%
——2Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.4d