CWE-306 · Missing Authentication for Critical Function (page 11)
Page 11 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25791 | High | 7.5 | 2026-02-09 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap mes… |
CVE-2026-25848 | Critical | 9.1 | 2026-02-09 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible |
CVE-2026-2234 | Critical | 9.1 | 2026-02-09 | C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read and modify any user's mail content. |
CVE-2026-2165 | High | 7.3 | 2026-02-08 | A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the… |
CVE-2020-37157 | High | 7.5 | 2026-02-07 | DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unp… |
CVE-2020-37146 | High | 7.5 | 2026-02-07 | ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration fi… |
CVE-2026-25593 | High | 8.4 | 2026-02-06 | OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply a… |
CVE-2026-2065 | Medium | 6.3 | 2026-02-06 | A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown functionality of the component Bluetooth Low… |
CVE-2026-25751 | High | 7.5 | 2026-02-06 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote att… |
CVE-2026-25505 | Critical | 9.8 | 2026-02-04 | Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Prior to version 0.1.7, a hardcoded secret key used for signing JWTs i… |
CVE-2026-1633 | Critical | 10.0 | 2026-02-04 | The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated use… |
CVE-2026-1632 | Critical | 9.1 | 2026-02-03 | MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated at… |
CVE-2026-1341 | | 2026-02-03 | Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control. | |
CVE-2026-25137 | Critical | 9.1 | 2026-02-02 | The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database m… |
CVE-2022-50981 | Critical | 9.8 | 2026-02-02 | An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforc… |
CVE-2022-50980 | Medium | 6.5 | 2026-02-02 | A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN. |
CVE-2022-50979 | Medium | 6.5 | 2026-02-02 | An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485). |
CVE-2022-50978 | High | 7.5 | 2026-02-02 | An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP). |
CVE-2022-50977 | High | 7.5 | 2026-02-02 | An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP. |
CVE-2026-24728 | | 2026-01-30 | A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remot… | |
CVE-2026-25116 | High | 7.6 | 2026-01-29 | Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `Us… |
CVE-2026-1453 | Critical | 9.8 | 2026-01-29 | A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrat… |
CVE-2020-36963 | High | 7.5 | 2026-01-28 | Intelbras Router RF 301K firmware version 1.1.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to download router config… |
CVE-2025-12386 | | 2026-01-27 | Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoin… | |
CVE-2025-59097 | | 2026-01-26 | The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the d… | |
CVE-2025-59090 | | 2026-01-26 | On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network acces… | |
CVE-2026-1410 | Medium | 6.4 | 2026-01-26 | A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the component UART Interface. The manipulation res… |
CVE-2025-52024 | Critical | 9.4 | 2026-01-23 | A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By ac… |
CVE-2026-24423 | Critical | 9.8 | 2026-01-23 | SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attack… |
CVE-2021-47891 | Critical | 9.8 | 2026-01-23 | Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. A… |
CVE-2026-1364 | Critical | 9.8 | 2026-01-23 | IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative fu… |
CVE-2026-0778 | High | 8.8 | 2026-01-23 | Enel X JuiceBox 40 Telnet Service Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2026-24124 | Critical | 9.8 | 2026-01-22 | Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) l… |
CVE-2025-54816 | Critical | 9.4 | 2026-01-22 | This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections… |
CVE-2026-1332 | Medium | 5.3 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access specific API functi… |
CVE-2025-69285 | Medium | 6.1 | 2026-01-21 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in t… |
CVE-2021-47802 | High | 7.5 | 2026-01-21 | Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files… |
CVE-2026-23944 | Critical | 9.8 | 2026-01-19 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to rem… |
CVE-2026-23744 | Critical | 9.8 | 2026-01-16 | MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerabilit… |
CVE-2026-0942 | Medium | 5.3 | 2026-01-16 | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing cap… |
CVE-2026-1023 | High | 7.5 | 2026-01-16 | Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a speci… |
CVE-2025-62582 | Critical | 9.8 | 2026-01-16 | Delta Electronics DIAView has multiple vulnerabilities. |
CVE-2026-23746 | | 2026-01-15 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2025-14058 | Low | 3.2 | 2026-01-14 | A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Contr… |
CVE-2026-22238 | Critical | 9.8 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerabi… |
CVE-2023-54335 | Critical | 9.8 | 2026-01-13 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers… |
CVE-2026-20803 | High | 7.2 | 2026-01-13 | Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-12548 | Critical | 9.0 | 2026-01-13 | A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH key… |
CVE-2026-0492 | High | 8.8 | 2026-01-13 | SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining a… |
CVE-2026-22812 | High | 8.8 | 2026-01-12 | OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or an… |
CVE-2026-22788 | High | 8.2 | 2026-01-12 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive… |
CVE-2026-0842 | Medium | 6.3 | 2026-01-11 | A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulat… |
CVE-2025-69425 | | 2026-01-09 | The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authe… | |
CVE-2025-66049 | High | 7.5 | 2026-01-09 | Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP p… |
CVE-2025-68716 | High | 8.4 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no passwor… |
CVE-2025-68715 | Critical | 9.1 | 2026-01-08 | An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/goform/setWan, /goform/setLan, /goform/wirel… |
CVE-2025-65731 | Medium | 6.8 | 2026-01-08 | An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical access to the UART pins… |
CVE-2025-15346 | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… | |
CVE-2017-20213 | High | 7.5 | 2026-01-08 | FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows remote attackers to access live camera str… |
CVE-2026-0650 | | 2026-01-07 | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normal… | |
CVE-2025-31963 | Low | 2.9 | 2026-01-07 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform una… |
CVE-2026-0625 | | 2026-01-05 | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauth… | |
CVE-2025-14346 | Critical | 9.8 | 2026-01-05 | WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with th… |
CVE-2025-15026 | Critical | 9.8 | 2026-01-05 | Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not P… |
CVE-2025-3646 | High | 7.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared o… |
CVE-2026-21446 | Critical | 9.8 | 2026-01-02 | Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation i… |
CVE-2026-21445 | Critical | 9.1 | 2026-01-02 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are mi… |
CVE-2020-36904 | High | 7.5 | 2025-12-31 | Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the… |
CVE-2024-58336 | Medium | 5.3 | 2025-12-30 | Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endp… |
CVE-2022-50790 | High | 7.5 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream informat… |
CVE-2025-66377 | High | 7.5 | 2025-12-25 | Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execut… |
CVE-2025-3232 | High | 7.5 | 2025-12-24 | A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands. |
CVE-2019-25248 | High | 7.5 | 2025-12-24 | Beward N100 M2.1.6.04C014 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers ca… |
CVE-2019-25240 | Critical | 9.8 | 2025-12-24 | Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exp… |
CVE-2019-25236 | Critical | 9.8 | 2025-12-24 | iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers… |
CVE-2018-25141 | High | 7.5 | 2025-12-24 | FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers… |
CVE-2018-25140 | High | 7.5 | 2025-12-24 | FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass aut… |
CVE-2018-25139 | High | 7.5 | 2025-12-24 | FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attack… |
CVE-2018-25137 | High | 7.5 | 2025-12-24 | FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configurat… |
CVE-2018-25136 | High | 7.5 | 2025-12-24 | FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Atta… |
CVE-2018-25134 | Critical | 9.8 | 2025-12-24 | Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to cre… |
CVE-2025-66445 | High | 7.1 | 2025-12-24 | Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component) and Hitachi Ops Center Analyzer (Hitachi Ops C… |
CVE-2025-65856 | Critical | 9.8 | 2025-12-22 | Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attack… |
CVE-2023-53974 | High | 7.5 | 2025-12-22 | D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST… |
CVE-2023-53970 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-boun… |
CVE-2023-53969 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addres… |
CVE-2023-53968 | Critical | 9.8 | 2025-12-22 | Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addres… |
CVE-2023-53967 | High | 7.5 | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the cu… |
CVE-2023-53964 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to re… |
CVE-2025-12049 | Critical | 9.8 | 2025-12-22 | Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may access to the web i… |
CVE-2023-47232 | Medium | 4.3 | 2025-12-21 | Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6. |
CVE-2025-14300 | High | 8.1 | 2025-12-20 | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
CVE-2025-52692 | High | 8.8 | 2025-12-19 | Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration… |
CVE-2025-63390 | Medium | 5.3 | 2025-12-18 | An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication… |
CVE-2025-63389 | Critical | 9.8 | 2025-12-18 | A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multi… |
CVE-2025-65010 | | 2025-12-18 | WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious a… | |
CVE-2025-65007 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the… | |
CVE-2025-43428 | Critical | 9.8 | 2025-12-17 | A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in t… |
CVE-2025-34434 | Critical | 9.1 | 2025-12-17 | AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for… |
CVE-2023-53896 | High | 7.5 | 2025-12-16 | D-Link DAP-1325 firmware version 1.01 contains a broken access control vulnerability that allows unauthenticated attackers to download device configuration set… |