CWE-306 · Missing Authentication for Critical Function (page 12)
Page 12 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14038 | High | 7.0 | 2025-12-15 | EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read pote… |
CVE-2025-14567 | Medium | 5.3 | 2025-12-12 | A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the fil… |
CVE-2025-12348 | Medium | 5.3 | 2025-12-12 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, an… |
CVE-2025-67780 | Medium | 4.2 | 2025-12-11 | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MA… |
CVE-2024-58300 | | 2025-12-11 | Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated cre… | |
CVE-2025-65828 | Medium | 6.5 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would res… |
CVE-2025-65824 | High | 8.8 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy… |
CVE-2020-36894 | High | 7.5 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through… |
CVE-2020-36892 | Critical | 9.8 | 2025-12-10 | Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to mod… |
CVE-2025-13607 | Critical | 9.4 | 2025-12-10 | A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL. |
CVE-2024-2104 | High | 8.8 | 2025-12-10 | Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands throug… |
CVE-2023-53774 | Critical | 9.8 | 2025-12-09 | MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. A… |
CVE-2023-53773 | Medium | 5.3 | 2025-12-09 | MiniDVBLinux 5.4 contains an unauthenticated vulnerability in the tv_action.sh script that allows remote attackers to generate live stream snapshots through th… |
CVE-2023-53771 | Critical | 9.8 | 2025-12-09 | MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can… |
CVE-2021-47731 | Critical | 9.8 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented pag… |
CVE-2021-47727 | Medium | 5.3 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication. Atta… |
CVE-2021-47710 | | 2025-12-09 | COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /ove… | |
CVE-2021-47709 | | 2025-12-09 | COMMAX Smart Home System allows an unauthenticated attacker to change configuration and cause denial-of-service through the setconf endpoint. Attackers can tri… | |
CVE-2025-59516 | High | 7.8 | 2025-12-09 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-34414 | | 2025-12-09 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2025-12941 | Medium | 5.7 | 2025-12-09 | Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the… |
CVE-2025-42875 | Medium | 6.6 | 2025-12-09 | The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse au… |
CVE-2025-48608 | Medium | 5.5 | 2025-12-08 | In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information… |
CVE-2025-48572 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of pri… |
CVE-2025-27020 | Critical | 9.8 | 2025-12-08 | Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . … |
CVE-2025-27019 | Critical | 9.8 | 2025-12-08 | Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activ… |
CVE-2025-64056 | Medium | 4.3 | 2025-12-05 | File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem. |
CVE-2025-66555 | | 2025-12-04 | AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the… | |
CVE-2025-63896 | High | 7.6 | 2025-12-04 | An issue in the Bluetooth Human Interface Device (HID) of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to inject arbitrary keystroke… |
CVE-2025-27935 | | 2025-12-04 | The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state wi… | |
CVE-2025-54158 | High | 7.8 | 2025-12-04 | Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitr… |
CVE-2025-13510 | | 2025-12-02 | The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to ac… | |
CVE-2025-59695 | Critical | 9.8 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a user with OS root access to alter firmware on the Chassis Management… |
CVE-2025-13870 | Low | 3.1 | 2025-12-02 | Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… |
CVE-2025-55222 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-55221 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially… |
CVE-2025-54851 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54850 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54849 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-54848 | High | 7.5 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted seri… |
CVE-2025-23417 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2025-20085 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can… |
CVE-2024-49572 | High | 7.2 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2024-48882 | High | 8.6 | 2025-12-01 | A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to d… |
CVE-2025-65112 | Critical | 9.4 | 2025-11-29 | PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to uplo… |
CVE-2020-36874 | | 2025-11-26 | ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoin… | |
CVE-2020-36873 | | 2025-11-26 | Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backu… | |
CVE-2020-36871 | | 2025-11-26 | ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint all… | |
CVE-2019-25227 | | 2025-11-26 | Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management endpoint. The endpoin… | |
CVE-2019-25226 | | 2025-11-26 | Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_system_config manageme… | |
CVE-2025-13483 | | 2025-11-25 | SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs. This allows an unauthenticated attacker to bypass the login screen using browser develope… | |
CVE-2025-12003 | | 2025-11-25 | A path traversal vulnerability has been identified in WebDAV, which may allow unauthenticated remote attackers to impact the integrity of the device. Refer to… | |
CVE-2024-14007 | | 2025-11-24 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authenticatio… | |
CVE-2025-63958 | Critical | 9.8 | 2025-11-24 | MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This pa… |
CVE-2025-63435 | Medium | 4.3 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update pa… |
CVE-2025-12969 | Medium | 6.5 | 2025-11-24 | Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows re… |
CVE-2025-11771 | Medium | 5.3 | 2025-11-21 | The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modifica… |
CVE-2025-64770 | Medium | 6.8 | 2025-11-20 | The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to c… |
CVE-2025-62674 | Medium | 6.8 | 2025-11-20 | The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera c… |
CVE-2025-63206 | Critical | 9.8 | 2025-11-19 | An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain esc… |
CVE-2025-34331 | High | 7.5 | 2025-11-19 | AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download… |
CVE-2025-12349 | Medium | 5.3 | 2025-11-19 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and includ… |
CVE-2025-9312 | Critical | 9.8 | 2025-11-18 | A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 p… |
CVE-2025-64307 | Medium | 6.5 | 2025-11-15 | The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to m… |
CVE-2025-59780 | High | 7.5 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to… |
CVE-2025-58083 | Critical | 10.0 | 2025-11-15 | General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the d… |
CVE-2023-7328 | Medium | 5.3 | 2025-11-14 | Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests… |
CVE-2021-4469 | | 2025-11-14 | Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication. While the pri… | |
CVE-2021-4468 | | 2025-11-14 | PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker c… | |
CVE-2025-55073 | Medium | 5.4 | 2025-11-14 | Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams… |
CVE-2025-55070 | Medium | 6.5 | 2025-11-14 | Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information… |
CVE-2025-59367 | Critical | 9.8 | 2025-11-13 | An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec… |
CVE-2023-7329 | | 2025-11-12 | Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A rem… | |
CVE-2025-40817 | Medium | 6.5 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-40816 | High | 7.6 | 2025-11-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6… |
CVE-2025-11986 | Medium | 5.3 | 2025-11-11 | The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unau… |
CVE-2025-42885 | Medium | 5.8 | 2025-11-11 | Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view informa… |
CVE-2025-12447 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-12444 | Medium | 4.2 | 2025-11-10 | Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2025-12436 | Medium | 5.9 | 2025-11-10 | Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potenti… |
CVE-2022-50595 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50594 | High | 7.5 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50593 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50592 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50591 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2025-20358 | Critical | 9.4 | 2025-11-05 | A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentic… |
CVE-2025-55108 | Critical | 10.0 | 2025-11-05 | The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS… |
CVE-2025-12108 | | 2025-11-04 | The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login pro… | |
CVE-2025-61956 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify co… |
CVE-2025-61945 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker c… |
CVE-2025-47357 | High | 8.0 | 2025-11-04 | Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions. |
CVE-2025-11007 | Critical | 9.8 | 2025-11-04 | The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_si… |
CVE-2025-8558 | Medium | 5.4 | 2025-11-03 | Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent… |
CVE-2025-48397 | High | 7.1 | 2025-11-03 | The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script… |
CVE-2025-52665 | Critical | 10.0 | 2025-10-31 | A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a manag… |
CVE-2023-7325 | | 2025-10-30 | Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrp… | |
CVE-2021-4461 | | 2025-10-30 | Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The d… | |
CVE-2025-12477 | Critical | 9.8 | 2025-10-29 | Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-12476 | Critical | 9.8 | 2025-10-29 | Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
CVE-2025-41090 | | 2025-10-28 | microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other… |