CWE-306 · Missing Authentication for Critical Function (page 16)
Page 16 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27647 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication… |
CVE-2025-27642 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Editing V-2024-008. |
CVE-2025-24924 | Critical | 9.8 | 2025-03-05 | Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username |
CVE-2025-0159 | Critical | 9.1 | 2025-02-28 | IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5… |
CVE-2025-1717 | High | 8.1 | 2025-02-27 | The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication ba… |
CVE-2025-21355 | High | 8.6 | 2025-02-19 | Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network |
CVE-2024-57055 | Medium | 5.0 | 2025-02-18 | Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the ne… |
CVE-2025-25224 | High | 7.5 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If… |
CVE-2024-57725 | Medium | 6.5 | 2025-02-14 | An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an interne… |
CVE-2025-24865 | Critical | 10.0 | 2025-02-13 | The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sens… |
CVE-2025-1283 | Critical | 9.8 | 2025-02-13 | The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page. |
CVE-2025-0896 | Critical | 9.8 | 2025-02-13 | Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access b… |
CVE-2025-0108 | Critical | 9.1 | 2025-02-12 | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to b… |
CVE-2025-26366 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26365 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26364 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26363 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26362 | High | 7.5 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26361 | Critical | 9.1 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauth… |
CVE-2025-26360 | Medium | 5.3 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an… |
CVE-2025-26359 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an una… |
CVE-2025-26347 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthe… |
CVE-2025-26345 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthe… |
CVE-2025-26344 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an u… |
CVE-2025-26342 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an una… |
CVE-2025-26341 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an una… |
CVE-2025-26339 | Critical | 9.8 | 2025-02-12 | A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenti… |
CVE-2025-21198 | Critical | 9.0 | 2025-02-11 | Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability |
CVE-2024-10649 | Medium | 6.1 | 2025-02-10 | wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads f… |
CVE-2024-54176 | Medium | 4.3 | 2025-02-08 | IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and… |
CVE-2024-36555 | Critical | 9.8 | 2025-02-06 | Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36… |
CVE-2024-9644 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is… |
CVE-2024-12511 | High | 7.6 | 2025-02-03 | With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and pr… |
CVE-2024-12957 | | 2025-01-23 | A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer to the '01/23/2025 Security Update for… | |
CVE-2024-12857 | Critical | 9.8 | 2025-01-22 | The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly ver… |
CVE-2025-21559 | Medium | 5.5 | 2025-01-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and… |
CVE-2025-21535 | Critical | 9.8 | 2025-01-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2025-21524 | Critical | 9.8 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affe… |
CVE-2025-21515 | High | 8.8 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-24456 | Medium | 6.7 | 2025-01-21 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping |
CVE-2024-12757 | High | 8.6 | 2025-01-17 | Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code. |
CVE-2025-0456 | Critical | 9.8 | 2025-01-16 | The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrat… |
CVE-2025-0355 | High | 7.5 | 2025-01-15 | Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS… |
CVE-2024-39773 | Medium | 5.3 | 2025-01-14 | An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead… |
CVE-2024-39608 | Critical | 10.0 | 2025-01-14 | A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitr… |
CVE-2024-39273 | Critical | 9.0 | 2025-01-14 | A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbi… |
CVE-2024-35277 | High | 8.6 | 2025-01-14 | A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7… |
CVE-2024-12847 | Critical | 9.8 | 2025-01-10 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating… |
CVE-2024-13186 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-13185 | High | 7.5 | 2025-01-08 | The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2024-13173 | High | 7.5 | 2025-01-08 | The health module has insufficient restrictions on loading URLs, which may lead to some information leakage. |
CVE-2025-21623 | High | 7.5 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template director… |
CVE-2024-55538 | Medium | 4.0 | 2025-01-02 | Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis Tru… |
CVE-2024-12106 | Critical | 9.4 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings. |
CVE-2024-56799 | Critical | 10.0 | 2024-12-30 | Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API ro… |
CVE-2024-7726 | Medium | 6.8 | 2024-12-20 | There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that… |
CVE-2024-54984 | Critical | 9.8 | 2024-12-19 | An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier. |
CVE-2024-54983 | Critical | 9.8 | 2024-12-19 | An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message. |
CVE-2024-12371 | | 2024-12-18 | A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user withou… | |
CVE-2021-26280 | High | 7.9 | 2024-12-17 | Locally installed application can bypass the permission check and perform system operations that require permission. |
CVE-2021-26278 | Medium | 6.3 | 2024-12-17 | The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device. |
CVE-2020-12484 | Medium | 6.4 | 2024-12-17 | When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a ca… |
CVE-2024-10205 | Critical | 9.4 | 2024-12-17 | Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure… |
CVE-2024-11639 | Critical | 10.0 | 2024-12-10 | An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access |
CVE-2024-10776 | High | 8.2 | 2024-12-06 | Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creatin… |
CVE-2024-10774 | High | 7.3 | 2024-12-06 | Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication. |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-42456 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuratio… |
CVE-2024-42455 | High | 8.1 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a se… |
CVE-2024-40717 | High | 8.8 | 2024-12-04 | A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs… |
CVE-2024-37303 | Medium | 5.3 | 2024-12-03 | Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and cach… |
CVE-2024-50381 | | 2024-12-02 | A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices. The attacker only… | |
CVE-2024-53623 | High | 7.5 | 2024-11-29 | Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information. |
CVE-2024-53701 | Low | 3.1 | 2024-11-29 | Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. … |
CVE-2024-11980 | High | 8.6 | 2024-11-29 | Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the sp… |
CVE-2024-49052 | High | 8.2 | 2024-11-26 | Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. |
CVE-2024-50375 | Critical | 9.8 | 2024-11-26 | A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EK… |
CVE-2024-11680 | Critical | 9.8 | 2024-11-26 | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sendin… |
CVE-2024-33616 | Medium | 5.3 | 2024-11-26 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states… |
CVE-2020-12492 | | 2024-11-25 | Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information. | |
CVE-2020-12491 | | 2024-11-25 | Improper control of framework service permissions with possibility of some sensitive device information leakage. | |
CVE-2024-47138 | Critical | 9.8 | 2024-11-22 | The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed. |
CVE-2024-5721 | High | 8.1 | 2024-11-22 | Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-5718 | High | 8.1 | 2024-11-22 | Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-38643 | Critical | 9.8 | 2024-11-22 | A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote at… |
CVE-2024-21855 | Critical | 9.8 | 2024-11-21 | A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command exe… |
CVE-2024-52438 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in deco.agency de:branding debranding allows Privilege Escalation.This issue affects de:branding: fr… |
CVE-2024-52437 | High | 8.8 | 2024-11-20 | Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System banner-system allows Privilege Escalation.This issue affects B… |
CVE-2024-47865 | Medium | 5.3 | 2024-11-20 | Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited… |
CVE-2024-0012 | Critical | 9.8 | 2024-11-18 | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain… |
CVE-2024-41969 | High | 8.8 | 2024-11-18 | A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full… |
CVE-2024-41968 | Medium | 5.4 | 2024-11-18 | A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS. |
CVE-2024-41967 | High | 8.1 | 2024-11-18 | A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denia… |
CVE-2024-10924 | Critical | 9.8 | 2024-11-15 | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is d… |
CVE-2024-48966 | Critical | 10.0 | 2024-11-14 | The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC w… |
CVE-2024-39707 | Medium | 5.3 | 2024-11-14 | Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible ro… |
CVE-2024-40408 | High | 7.3 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. This vulnerability allo… |
CVE-2024-40405 | High | 8.1 | 2024-11-13 | Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request. |
CVE-2024-40404 | Critical | 9.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are… |