looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available.
Is that possible a weakness in $GHASH$ compromise plain-text or it just allow attacker to forge it? can we use AES-GCM with confidence or is better to use a confidential only mode for encryption and HMAC cipher-text with same key to protect plain-text in long terms?
How strong is GCM authentication compared to HMAC-SHA256? what is poly time to forge plain-text?
Where attacker can practically forge plain-text in real life? adding malicious codes to software downloads? what if plain-text is padded? can he identify and change chat messages? where else?