CWE-306 · Missing Authentication for Critical Function (page 15)
Page 15 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3090 | High | 8.2 | 2025-06-24 | An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function. |
CVE-2025-48469 | Critical | 9.6 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to ba… |
CVE-2025-34039 | | 2025-06-24 | A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without p… | |
CVE-2025-3319 | High | 8.1 | 2025-06-20 | IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access… |
CVE-2025-32879 | High | 8.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to con… |
CVE-2025-32876 | Medium | 6.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. The BLE implementation of the COROS smartwatch does not support LE Secure Connections and ins… |
CVE-2025-32896 | Medium | 6.5 | 2025-06-19 | # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can… |
CVE-2025-25265 | Medium | 4.9 | 2025-06-16 | A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to rea… |
CVE-2025-49596 | | 2025-06-13 | The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due… | |
CVE-2024-35295 | Medium | 6.1 | 2025-06-11 | A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 20… |
CVE-2024-9062 | High | 7.8 | 2025-06-11 | The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.ar… |
CVE-2025-5906 | High | 7.3 | 2025-06-10 | A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation le… |
CVE-2025-26468 | High | 7.5 | 2025-06-09 | CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption. |
CVE-2025-49652 | Critical | 9.8 | 2025-06-09 | Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when… |
CVE-2025-5876 | Medium | 5.3 | 2025-06-09 | A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unkn… |
CVE-2025-5872 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting H… |
CVE-2025-5871 | Medium | 5.3 | 2025-06-09 | A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2025-3461 | Critical | 9.1 | 2025-06-08 | The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Functi… |
CVE-2024-55585 | | 2025-06-07 | In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write… | |
CVE-2025-5192 | High | 7.5 | 2025-06-06 | A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2… |
CVE-2025-5719 | | 2025-06-06 | The wallet has an authentication bypass vulnerability that allows access to specific pages. | |
CVE-2025-5715 | Low | 3.8 | 2025-06-06 | A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biomet… |
CVE-2025-1701 | | 2025-06-04 | CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request ov… | |
CVE-2025-47272 | Medium | 5.5 | 2025-06-02 | The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring… |
CVE-2025-1907 | Critical | 9.8 | 2025-05-30 | Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected. |
CVE-2025-22252 | Critical | 9.8 | 2025-05-28 | A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4… |
CVE-2025-32440 | Critical | 10.0 | 2025-05-27 | NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to u… |
CVE-2025-41651 | Critical | 9.8 | 2025-05-27 | Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling una… |
CVE-2025-2407 | | 2025-05-27 | Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability… | |
CVE-2025-48742 | Medium | 5.4 | 2025-05-27 | The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. |
CVE-2025-40664 | Critical | 9.1 | 2025-05-26 | Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestio… |
CVE-2025-41655 | High | 7.5 | 2025-05-26 | An unauthenticated remote attacker can access a URL which causes the device to reboot. |
CVE-2025-41654 | High | 8.2 | 2025-05-26 | An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by th… |
CVE-2025-36535 | Critical | 10.0 | 2025-05-21 | The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration changes, operational di… |
CVE-2025-4008 | High | 8.8 | 2025-05-21 | The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web… |
CVE-2025-27803 | Medium | 6.5 | 2025-05-21 | The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets adm… |
CVE-2025-48391 | High | 7.7 | 2025-05-20 | In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |
CVE-2025-47850 | Medium | 4.3 | 2025-05-20 | In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning |
CVE-2025-32738 | Medium | 5.3 | 2025-05-15 | Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a… |
CVE-2025-0132 | | 2025-05-14 | A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the B… | |
CVE-2024-46506 | Critical | 10.0 | 2025-05-13 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authenticat… |
CVE-2025-44039 | Medium | 5.1 | 2025-05-13 | CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attacke… |
CVE-2024-23815 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highl… |
CVE-2025-4560 | Medium | 6.5 | 2025-05-12 | The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These f… |
CVE-2025-4557 | Critical | 9.1 | 2025-05-12 | The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-4555 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4382 | Medium | 5.9 | 2025-05-09 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks… |
CVE-2025-3759 | | 2025-05-08 | Endpoint /cgi-bin-igd/netcore_set.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security t… | |
CVE-2025-3758 | | 2025-05-08 | WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext… | |
CVE-2025-20210 | High | 7.3 | 2025-05-07 | A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify t… |
CVE-2025-4268 | Medium | 5.3 | 2025-05-05 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.c… |
CVE-2025-1495 | Medium | 4.3 | 2025-05-03 | IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation. |
CVE-2025-24271 | Medium | 5.4 | 2025-04-29 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sono… |
CVE-2025-4019 | High | 7.3 | 2025-04-28 | A vulnerability, which was classified as critical, was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. Affected is the function ge… |
CVE-2025-4018 | Medium | 5.3 | 2025-04-28 | A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the… |
CVE-2025-4015 | Medium | 5.3 | 2025-04-28 | A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the f… |
CVE-2025-46275 | Critical | 9.8 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing creden… |
CVE-2025-34028 | Critical | 10.0 | 2025-04-22 | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the… |
CVE-2025-32377 | Medium | 6.5 | 2025-04-18 | Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been ident… |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2025-32433 | Critical | 10.0 | 2025-04-16 | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an… |
CVE-2025-27538 | Low | 2.2 | 2025-04-16 | Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the ta… |
CVE-2025-30215 | Critical | 9.6 | 2025-04-16 | NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11… |
CVE-2025-32782 | Medium | 5.3 | 2025-04-15 | Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking… |
CVE-2025-30727 | Critical | 9.8 | 2025-04-15 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-2567 | Critical | 9.8 | 2025-04-15 | An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result… |
CVE-2025-0129 | | 2025-04-11 | An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy… | |
CVE-2025-3474 | Medium | 6.5 | 2025-04-09 | Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-29870 | High | 7.5 | 2025-04-09 | Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may ob… |
CVE-2024-41793 | High | 8.6 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices provides an endpoint that allows… |
CVE-2024-41791 | High | 7.3 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not authenticate report crea… |
CVE-2025-3248 | Critical | 9.8 | 2025-04-07 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send craft… |
CVE-2025-32357 | Medium | 4.3 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they h… |
CVE-2025-0257 | Medium | 6.3 | 2025-04-02 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its A… |
CVE-2025-25060 | High | 8.2 | 2025-04-02 | Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server where the product is… |
CVE-2024-13553 | Critical | 9.8 | 2025-04-01 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incl… |
CVE-2024-56469 | Medium | 6.3 | 2025-03-27 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1… |
CVE-2024-45356 | High | 7.3 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45355 | Medium | 5.5 | 2025-03-27 | A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers… |
CVE-2024-45483 | | 2025-03-25 | A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to… | |
CVE-2025-0256 | Medium | 4.3 | 2025-03-24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization f… |
CVE-2025-25068 | High | 7.5 | 2025-03-21 | Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated… |
CVE-2024-9919 | High | 8.4 | 2025-03-20 | A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninst… |
CVE-2024-8196 | Critical | 9.8 | 2025-03-20 | In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vu… |
CVE-2024-8057 | Medium | 4.3 | 2025-03-20 | In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue ari… |
CVE-2024-8053 | High | 8.2 | 2025-03-20 | In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the… |
CVE-2024-6842 | High | 7.5 | 2025-03-20 | In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data retu… |
CVE-2024-12869 | Medium | 4.3 | 2025-03-20 | In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead t… |
CVE-2024-50630 | High | 7.5 | 2025-03-19 | Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3… |
CVE-2025-30111 | High | 7.5 | 2025-03-18 | On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained acc… |
CVE-2024-23943 | Critical | 9.1 | 2025-03-18 | An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availabili… |
CVE-2025-2344 | Medium | 5.3 | 2025-03-16 | A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown f… |
CVE-2024-13772 | Medium | 5.6 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-13771 | Critical | 9.8 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-52285 | Medium | 5.3 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < V6.4.8). Affected de… |
CVE-2025-23194 | Medium | 5.3 | 2025-03-11 | SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user ca… |
CVE-2025-27256 | High | 8.3 | 2025-03-10 | Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serve… |
CVE-2025-1315 | Critical | 9.8 | 2025-03-07 | The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the p… |
CVE-2024-9658 | High | 8.8 | 2025-03-07 | The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including… |
CVE-2024-31525 | High | 7.2 | 2025-03-05 | Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain com… |