CWE-302 (CWE-302) — 3 disclosed vulnerabilities

Records the NVD classes under CWE-302, highest CVSS first.

CRITICAL 9.8CVE-2026-847312026-10-15
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the applicat…
AI risk analysis on Exploit-DB.ai →
MEDIUM 5.3CVE-2026-800922026-10-16
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-1142772026-11-05
Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affe…
AI risk analysis on Exploit-DB.ai →