CWE-306 · Missing Authentication for Critical Function (page 13)
Page 13 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43994 | High | 8.6 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated… |
CVE-2025-62607 | Medium | 5.3 | 2025-10-22 | Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service… |
CVE-2025-41110 | High | 8.8 | 2025-10-22 | Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi… |
CVE-2025-61756 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: System Conf… |
CVE-2025-62481 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2… |
CVE-2025-62287 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affect… |
CVE-2025-61757 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 a… |
CVE-2025-61752 | High | 7.5 | 2025-10-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14… |
CVE-2025-53072 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2… |
CVE-2025-53037 | Critical | 9.8 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-53034 | Medium | 5.4 | 2025-10-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2025-11949 | High | 7.5 | 2025-10-21 | EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain databas… |
CVE-2025-9574 | Critical | 10.0 | 2025-10-20 | Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Seri… |
CVE-2025-60856 | Medium | 6.8 | 2025-10-20 | Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to… |
CVE-2025-11942 | High | 7.3 | 2025-10-19 | A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authen… |
CVE-2025-11852 | Medium | 5.3 | 2025-10-16 | A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF S… |
CVE-2025-62586 | Critical | 9.8 | 2025-10-16 | OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0. |
CVE-2025-9152 | Critical | 9.8 | 2025-10-16 | An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations D… |
CVE-2025-0275 | Medium | 5.3 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowi… |
CVE-2025-0274 | Medium | 5.3 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint act… |
CVE-2025-11728 | Medium | 5.3 | 2025-10-15 | The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication a… |
CVE-2025-23356 | High | 8.4 | 2025-10-14 | NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. A successful exploit of this vulnerability might lead to code execution, denial of serv… |
CVE-2025-7328 | Critical | 9.8 | 2025-10-14 | Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical function… |
CVE-2025-40771 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All ver… |
CVE-2025-40765 | Critical | 9.8 | 2025-10-14 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information di… |
CVE-2025-41703 | High | 7.5 | 2025-10-14 | An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command. |
CVE-2025-11672 | Medium | 5.3 | 2025-10-13 | Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a speci… |
CVE-2025-11671 | Medium | 5.3 | 2025-10-13 | Uniweb/SoliPACS WebServer developed by EBM Technologies has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access a speci… |
CVE-2025-11661 | High | 7.3 | 2025-10-13 | A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Perform… |
CVE-2025-61928 | | 2025-10-09 | Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys… | |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-35051 | Critical | 9.8 | 2025-10-09 | Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attack… |
CVE-2025-35050 | Critical | 9.8 | 2025-10-09 | Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbi… |
CVE-2025-11198 | High | 7.4 | 2025-10-09 | A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based att… |
CVE-2025-11529 | High | 7.3 | 2025-10-09 | A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddlewar… |
CVE-2025-11171 | Medium | 5.3 | 2025-10-08 | The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9… |
CVE-2023-6215 | | 2025-10-07 | A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow… | |
CVE-2025-61778 | | 2025-10-06 | Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via ou… | |
CVE-2025-61777 | Critical | 9.4 | 2025-10-06 | Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/badge-templates` (GET) and `/api/admin/b… |
CVE-2025-10746 | Medium | 6.5 | 2025-10-04 | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing ca… |
CVE-2025-61673 | High | 8.6 | 2025-10-03 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when confi… |
CVE-2025-23293 | High | 8.7 | 2025-09-30 | NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exp… |
CVE-2025-10991 | | 2025-09-30 | The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device. Thi… | |
CVE-2025-34232 | Medium | 5.3 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34231 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34230 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34229 | Medium | 5.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34228 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34225 | High | 8.6 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain… |
CVE-2025-34224 | Critical | 9.1 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose … |
CVE-2025-34223 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain… |
CVE-2025-34222 | Critical | 9.1 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose… |
CVE-2025-34221 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose e… |
CVE-2025-34220 | Medium | 5.3 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains… |
CVE-2025-34218 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose… |
CVE-2025-34216 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose… |
CVE-2025-34215 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose… |
CVE-2025-34207 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH c… |
CVE-2025-11130 | High | 8.4 | 2025-09-29 | A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTo… |
CVE-2025-60251 | Medium | 5.0 | 2025-09-26 | Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring. |
CVE-2025-10906 | High | 8.4 | 2025-09-24 | A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endura… |
CVE-2025-41716 | Medium | 5.3 | 2025-09-24 | The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing au… |
CVE-2025-41715 | Critical | 9.8 | 2025-09-24 | The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially… |
CVE-2025-57432 | Critical | 9.8 | 2025-09-22 | Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manip… |
CVE-2025-9983 | | 2025-09-22 | GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials ar… | |
CVE-2025-10772 | Medium | 6.3 | 2025-09-22 | A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_… |
CVE-2025-34190 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployme… |
CVE-2022-4980 | | 2025-09-19 | General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentica… | |
CVE-2025-10672 | High | 7.8 | 2025-09-18 | A vulnerability was found in whuan132 AIBattery up to 1.0.9. The affected element is an unknown function of the file AIBatteryHelper/XPC/BatteryXPCService.swif… |
CVE-2025-59345 | Critical | 9.1 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web… |
CVE-2025-9971 | Critical | 9.8 | 2025-09-17 | Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthenticated remote attac… |
CVE-2025-56562 | High | 7.5 | 2025-09-16 | An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC address. |
CVE-2025-59358 | High | 7.5 | 2025-09-15 | The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to… |
CVE-2025-10452 | Critical | 9.8 | 2025-09-15 | Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delet… |
CVE-2025-10204 | | 2025-09-14 | A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the adm… | |
CVE-2025-58434 | Critical | 9.8 | 2025-09-12 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowis… |
CVE-2025-10267 | Medium | 5.3 | 2025-09-12 | NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If th… |
CVE-2025-9214 | Medium | 5.4 | 2025-09-11 | A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settin… |
CVE-2025-56405 | High | 7.5 | 2025-09-10 | An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE pr… |
CVE-2025-36757 | | 2025-09-10 | It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited a… | |
CVE-2025-36756 | | 2025-09-10 | A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known. | |
CVE-2025-7635 | High | 7.7 | 2025-09-09 | Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. |
CVE-2025-9994 | Critical | 9.8 | 2025-09-09 | The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with netw… |
CVE-2025-9160 | | 2025-09-09 | A code execution security issue exists in the affected product. An attacker with physical access could abuse the maintenance menu of the controller with a craf… | |
CVE-2025-7970 | High | 7.5 | 2025-09-09 | A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to dec… |
CVE-2025-42926 | Medium | 5.3 | 2025-09-09 | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Up… |
CVE-2025-58443 | Critical | 9.1 | 2025-09-06 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerabili… |
CVE-2025-7045 | Medium | 6.5 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_h… |
CVE-2025-52551 | | 2025-09-02 | E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system. | |
CVE-2025-9815 | High | 7.8 | 2025-09-02 | A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHel… |
CVE-2025-58318 | | 2025-09-01 | Delta Electronics DIAView has an authentication bypass vulnerability. | |
CVE-2025-7405 | High | 7.3 | 2025-09-01 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated att… |
CVE-2012-10062 | | 2025-08-30 | A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute… | |
CVE-2025-54942 | Critical | 9.8 | 2025-08-30 | A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access depl… |
CVE-2025-8861 | Critical | 9.8 | 2025-08-29 | TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents. |
CVE-2025-55583 | Critical | 9.8 | 2025-08-28 | D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endp… |
CVE-2023-7308 | High | 7.5 | 2025-08-27 | SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet… |
CVE-2025-30048 | | 2025-08-27 | The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication. | |
CVE-2025-30041 | | 2025-08-27 | The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data… | |
CVE-2025-30040 | | 2025-08-27 | The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls… |