CWE-288 使用候选路径或通道进行的认证绕过 类弱点 535 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-288 指认证绕过漏洞，即系统虽设有认证机制，却存在无需验证的备用路径或通道。攻击者常利用该缺陷，通过未受保护的接口或隐藏入口直接访问受限资源，从而规避身份校验。开发者应确保所有访问入口均强制实施统一且严格的认证策略，全面审查系统架构，消除任何未授权访问的潜在路径，以保障系统安全性。
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n); output [31:0] data_out; input [31:0] data_in, incoming_id, address; input clk, rst_n; wire write_auth, addr_auth; reg [31:0] data_out, acl_oh_allowlist, q; assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0; always @* acl_oh_allowlist <= 32'h8312; assign addr_auth = (address == 32'hF00) ? 1: 0; always @ (posedge clk or negedge rst_n) if (!rst_n) begin q <= 32'h0; data_out <= 32'h0; end else begin q <= (addr_auth & write_auth) ? data_in: q; data_out <= q; end end endmoduleassign addr_auth = (address == 32'hF00) ? 1: 0;| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-27049 | WordPress plugin Jobica Core 安全漏洞 — Jobica Core | 9.8 | Critical | 2026-03-25 |
| CVE-2026-25406 | WordPress plugin Tutor LMS Pro 安全漏洞 — Tutor LMS Pro | 8.1 | High | 2026-03-25 |
| CVE-2026-25357 | WordPress plugin Ultimate Membership Pro 安全漏洞 — Ultimate Membership Pro | 8.1 | High | 2026-03-25 |
| CVE-2026-25035 | WordPress plugin Contest Gallery 安全漏洞 — Contest Gallery | 9.8 | Critical | 2026-03-25 |
| CVE-2026-25002 | WordPress plugin LearnPress – Sepay Payment 安全漏洞 — LearnPress – Sepay Payment | 7.5 | High | 2026-03-25 |
| CVE-2026-24359 | WordPress plugin Dokan 安全漏洞 — Dokan | 8.8 | High | 2026-03-25 |
| CVE-2026-3214 | Drupal CAPTCHA 安全漏洞 — CAPTCHA | 9.1 | - | 2026-03-25 |
| CVE-2026-1917 | Drupal Login Disable 安全漏洞 — Login Disable | 9.8 | - | 2026-03-25 |
| CVE-2026-33315 | Vikunja 安全漏洞 — vikunja | 5.3 | - | 2026-03-24 |
| CVE-2026-23480 | Blinko 安全漏洞 — blinko | 8.8 | - | 2026-03-23 |
| CVE-2026-22733 | Spring Security 安全漏洞 — Spring Security | 8.2 | High | 2026-03-19 |
| CVE-2026-22731 | VMware Spring Boot 安全漏洞 — Spring Boot | 8.2 | High | 2026-03-19 |
| CVE-2026-32031 | OpenClaw 安全漏洞 — OpenClaw | 4.8 | Medium | 2026-03-19 |
| CVE-2026-32004 | OpenClaw 安全漏洞 — OpenClaw | 6.5 | Medium | 2026-03-19 |
| CVE-2026-25471 | WordPress plugin Admin Safety Guard 安全漏洞 — Admin Safety Guard | 8.1 | High | 2026-03-19 |
| CVE-2026-32130 | ZITADEL 安全漏洞 — zitadel | 7.5 | High | 2026-03-11 |
| CVE-2026-0602 | GitLab 安全漏洞 — GitLab | 4.3 | Medium | 2026-03-11 |
| CVE-2026-27842 | Micro Research MR-GM5L-S1和Micro Research MR-GM5A-L1 安全漏洞 — MR-GM5L-S1 | 9.1AI | CriticalAI | 2026-03-11 |
| CVE-2026-26117 | Microsoft Azure Connected Machine Agent 安全漏洞 — Arc Enabled Servers - Azure Connected Machine Agent | 7.8 | High | 2026-03-10 |
| CVE-2026-22572 | Fortinet FortiManager多款产品 安全漏洞 — FortiManager | 6.8 | High | 2026-03-10 |
| CVE-2026-27390 | WordPress plugin WeDesignTech Ultimate Booking Addon 安全漏洞 — WeDesignTech Ultimate Booking Addon | 8.8 | High | 2026-03-05 |
| CVE-2026-27389 | WordPress plugin WeDesignTech Ultimate Booking Addon 安全漏洞 — WeDesignTech Ultimate Booking Addon | 9.8 | Critical | 2026-03-05 |
| CVE-2026-30777 | EC-CUBE 安全漏洞 — EC-CUBE 4.1 series | 7.2 | - | 2026-03-05 |
| CVE-2026-20079 | Cisco Secure Firewall Management Center 安全漏洞 — Cisco Secure Firewall Management Center (FMC) | 10.0 | Critical | 2026-03-04 |
| CVE-2026-2628 | WordPress plugin All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login 安全漏洞 — All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login | 9.8 | Critical | 2026-03-03 |
| CVE-2026-28411 | WeGIA 安全漏洞 — WeGIA | 9.8 | Critical | 2026-02-27 |
| CVE-2026-27707 | seerr 安全漏洞 — seerr | 7.3 | High | 2026-02-27 |
| CVE-2026-22205 | SPIP 安全漏洞 — SPIP | 7.5 | High | 2026-02-26 |
| CVE-2026-1241 | Pelco Sarix Professional 3 Series 安全漏洞 — Sarix Professional IMP 3 Series | 9.1AI | CriticalAI | 2026-02-26 |
| CVE-2026-1779 | WordPress plugin User Registration & Membership 安全漏洞 — User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 8.1 | High | 2026-02-26 |
CWE-288（使用候选路径或通道进行的认证绕过） 是常见的弱点类别，本平台收录该类弱点关联的 535 条 CVE 漏洞。