CVE-2026-90481Critical· 9.2▾ MidnightIn PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63493High· 8.6Snipe-IT is an IT asset/license management system
CVE-2026-79680Medium· 4.5Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module
CVE-2026-82269High· 8.1Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware
CVE-2026-93928High· 7.3Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc
CVE-2026-58269High· 8.1Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing
CVE-2026-75627Critical· 9.8Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments