CWE-306 · Missing Authentication for Critical Function (page 10)
Page 10 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20995 | Medium | 5.3 | 2026-03-16 | Exposure of sensitive functionality to an unauthorized actor in Smart Switch prior to version 3.7.69.15 allows remote attackers to set a specific configuration. |
CVE-2017-20222 | High | 7.5 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 software version 1.2.0 contains an unauthenticated remote reboot vulnerability that allows attackers to trigger device rebo… |
CVE-2017-20220 | High | 7.5 | 2026-03-16 | Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowse… |
CVE-2017-20217 | High | 7.5 | 2026-03-16 | Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthent… |
CVE-2026-31944 | High | 7.6 | 2026-03-13 | LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect f… |
CVE-2026-31882 | High | 7.5 | 2026-03-13 | Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), al… |
CVE-2026-22192 | Critical | 9.9 | 2026-03-13 | Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management… |
CVE-2025-15515 | Medium | 5.5 | 2026-03-13 | The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a local network, it can… |
CVE-2025-13779 | High | 8.3 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2025-13778 | Medium | 6.5 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2026-3611 | Critical | 10.0 | 2026-03-12 | The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user mod… |
CVE-2026-32231 | High | 8.2 | 2026-03-12 | ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request bod… |
CVE-2026-31881 | High | 7.7 | 2026-03-11 | Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset reques… |
CVE-2019-25483 | High | 8.4 | 2026-03-11 | Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by u… |
CVE-2026-28229 | Critical | 9.8 | 2026-03-11 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates… |
CVE-2026-27897 | Critical | 10.0 | 2026-03-11 | Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the e… |
CVE-2026-30933 | High | 7.5 | 2026-03-10 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Pas… |
CVE-2026-2339 | High | 7.5 | 2026-03-10 | Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion… |
CVE-2026-23662 | High | 7.5 | 2026-03-10 | Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. |
CVE-2026-30885 | Medium | 5.3 | 2026-03-10 | WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requir… |
CVE-2026-1920 | Medium | 5.3 | 2026-03-10 | The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2026-1919 | Medium | 5.3 | 2026-03-10 | The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capa… |
CVE-2026-30824 | Critical | 9.8 | 2026-03-07 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*)… |
CVE-2026-25071 | High | 7.5 | 2026-03-07 | XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a missing authentication vulnerability in the /switch_config.src endpoint that… |
CVE-2026-30846 | High | 7.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—… |
CVE-2026-26288 | Critical | 9.4 | 2026-03-06 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-2754 | High | 7.5 | 2026-03-06 | Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with… |
CVE-2026-26051 | Critical | 9.4 | 2026-03-06 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-27603 | High | 7.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the char… |
CVE-2026-22552 | Critical | 9.4 | 2026-03-06 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-26125 | High | 8.6 | 2026-03-05 | Payment Orchestrator Service Elevation of Privilege Vulnerability |
CVE-2026-29613 | Medium | 5.9 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based sole… |
CVE-2026-29606 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the… |
CVE-2026-28485 | High | 8.4 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized loca… |
CVE-2026-28472 | High | 8.1 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when… |
CVE-2026-28468 | High | 7.7 | 2026-03-05 | OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiri… |
CVE-2026-28458 | High | 8.1 | 2026-03-05 | OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in… |
CVE-2026-28450 | Medium | 6.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and… |
CVE-2026-27944 | Critical | 9.8 | 2026-03-05 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses… |
CVE-2026-23767 | Critical | 9.8 | 2026-03-05 | ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide c… |
CVE-2026-27446 | Critical | 9.8 | 2026-03-04 | Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the… |
CVE-2026-27012 | Critical | 9.8 | 2026-03-03 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication by… |
CVE-2026-1775 | | 2026-03-03 | The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attacker to alter device parameters and run… | |
CVE-2025-30035 | | 2026-03-02 | The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username… | |
CVE-2026-2844 | High | 7.5 | 2026-02-28 | Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra… |
CVE-2026-28352 | Medium | 6.5 | 2026-02-27 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint… |
CVE-2025-15567 | Low | 3.3 | 2026-02-27 | Insufficient protection mechanisms in the Health Module may lead to partial information disclosure. |
CVE-2025-15509 | Medium | 4.3 | 2026-02-27 | The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2026-27028 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-27772 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-27767 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-25851 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-24731 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-20781 | Critical | 9.4 | 2026-02-27 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the b… |
CVE-2026-27449 | High | 7.5 | 2026-02-26 | Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API… |
CVE-2026-22207 | Critical | 9.8 | 2026-02-26 | OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT p… |
CVE-2026-27509 | High | 8.0 | 2026-02-26 | Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt… |
CVE-2026-3194 | Medium | 4.5 | 2026-02-25 | A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passph… |
CVE-2026-3192 | Medium | 5.6 | 2026-02-25 | A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the compon… |
CVE-2026-27846 | Medium | 6.2 | 2026-02-25 | Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network to gain… |
CVE-2026-2624 | Critical | 9.8 | 2026-02-25 | Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentic… |
CVE-2026-27595 | High | 7.5 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (POST `/a… |
CVE-2026-26340 | High | 7.5 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can… |
CVE-2026-27584 | High | 7.5 | 2026-02-24 | Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unaut… |
CVE-2025-14577 | Critical | 9.8 | 2026-02-24 | Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sendin… |
CVE-2026-3053 | High | 7.3 | 2026-02-24 | A vulnerability was determined in DataLinkDC dinky up to 1.2.5. This affects the function addInterceptors of the file dinky-admin/src/main/java/org/dinky/confi… |
CVE-2026-23693 | Critical | 10.0 | 2026-02-23 | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST en… |
CVE-2026-27471 | Critical | 9.1 | 2026-02-21 | ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access… |
CVE-2026-26048 | High | 7.5 | 2026-02-20 | The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassoci… |
CVE-2026-24790 | High | 8.2 | 2026-02-20 | The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication. |
CVE-2025-30410 | Critical | 9.8 | 2026-02-20 | Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS… |
CVE-2026-26319 | High | 7.5 | 2026-02-19 | OpenClaw is a personal AI assistant. Versions 2026.2.13 and below allow the optional @openclaw/voice-call plugin Telnyx webhook handler to accept unsigned inbo… |
CVE-2025-8350 | Critical | 9.8 | 2026-02-19 | Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authe… |
CVE-2025-14294 | Medium | 5.3 | 2026-02-19 | The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() f… |
CVE-2026-27182 | High | 8.4 | 2026-02-18 | Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially… |
CVE-2025-1272 | High | 7.7 | 2026-02-18 | The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may all… |
CVE-2025-70147 | High | 7.5 | 2026-02-18 | Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitiv… |
CVE-2025-70146 | Critical | 9.1 | 2026-02-18 | Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perf… |
CVE-2025-70141 | Critical | 9.4 | 2026-02-18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication… |
CVE-2026-1670 | Critical | 9.8 | 2026-02-17 | The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery… |
CVE-2025-7706 | Medium | 6.1 | 2026-02-17 | Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion. … |
CVE-2026-2577 | Critical | 10.0 | 2026-02-16 | The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does not require authentica… |
CVE-2025-32063 | Medium | 6.8 | 2026-02-15 | There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup phase of a specific s… |
CVE-2025-6792 | Medium | 5.3 | 2026-02-14 | The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppyli… |
CVE-2026-26333 | Critical | 9.8 | 2026-02-13 | Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (inc… |
CVE-2026-26190 | Critical | 9.8 | 2026-02-13 | Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enabl… |
CVE-2025-14349 | High | 8.8 | 2026-02-13 | Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Fu… |
CVE-2026-26055 | High | 7.5 | 2026-02-12 | Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller (ATC) compon… |
CVE-2026-26235 | High | 7.5 | 2026-02-12 | JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Att… |
CVE-2026-1729 | Critical | 9.8 | 2026-02-12 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly ve… |
CVE-2026-25084 | Critical | 9.8 | 2026-02-11 | Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs. |
CVE-2026-24789 | Critical | 9.8 | 2026-02-11 | An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. |
CVE-2026-2249 | Critical | 9.8 | 2026-02-11 | METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2026-2248 | Critical | 9.8 | 2026-02-11 | METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpo… |
CVE-2025-8025 | Critical | 9.8 | 2026-02-11 | Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality… |
CVE-2026-1603 | High | 8.6 | 2026-02-10 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. |
CVE-2026-25938 | Critical | 9.8 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an u… |
CVE-2026-25895 | Critical | 9.8 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to… |
CVE-2026-25885 | High | 7.5 | 2026-02-09 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-16 and earlier, the group chat WebSocket at wss://polarlearn.nl/api/v1/ws can be used wi… |
CVE-2026-25878 | Medium | 5.3 | 2026-02-09 | FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authenticati… |