CWE-306 · Missing Authentication for Critical Function (page 3)
Page 3 of 35 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-83108 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83104 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83100 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83099 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83098 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83095 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83094 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12… |
CVE-2026-83066 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83062 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83061 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83060 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83059 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83054 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2… |
CVE-2026-83042 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-83037 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83036 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83035 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-83021 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4… |
CVE-2026-83020 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-83000 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12… |
CVE-2026-82995 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-82994 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-76701 | Medium | 5.9 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive informatio… |
CVE-2026-73963 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73961 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2026-73956 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73953 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73952 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73950 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73947 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73944 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73940 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71133 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-70913 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70757 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70756 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70748 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-81238 | High | 7.5 | 2026-09-15 | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker w… |
CVE-2026-12910 | Medium | 5.4 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-59160 | High | 8.8 | 2026-09-15 | Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages… |
CVE-2026-18111 | | 2026-09-15 | Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete… | |
CVE-2026-59971 | Critical | 10.0 | 2026-09-15 | MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/… |
CVE-2026-49254 | | 2026-09-15 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and… | |
CVE-2026-91996 | High | 7.5 | 2026-09-15 | lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system… |
CVE-2026-57140 | Critical | 9.4 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/s… |
CVE-2026-57139 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction a… |
CVE-2026-57112 | High | 8.3 | 2026-09-15 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-a… |
CVE-2026-91002 | Medium | 5.3 | 2026-09-15 | A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component… |
CVE-2026-90896 | | 2026-09-14 | Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /… | |
CVE-2026-53714 | High | 7.4 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRP… |
CVE-2026-12763 | Medium | 4.2 | 2026-09-14 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in… |
CVE-2026-54246 | Medium | 5.7 | 2026-09-14 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without ap… |
CVE-2026-59178 | Critical | 9.8 | 2026-09-14 | ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication crede… |
CVE-2026-90944 | High | 8.2 | 2026-09-14 | Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary ema… |
CVE-2026-55837 | Medium | 6.8 | 2026-09-14 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /d… |
CVE-2026-57131 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs withou… |
CVE-2026-57127 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or J… |
CVE-2026-57124 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and ac… |
CVE-2026-57128 | Medium | 4.3 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not cons… |
CVE-2026-57125 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-… |
CVE-2026-57123 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse an… |
CVE-2026-90938 | High | 8.6 | 2026-09-14 | LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated… |
CVE-2026-90898 | Critical | 9.8 | 2026-09-14 | Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the clie… |
CVE-2026-82787 | Critical | 9.8 | 2026-09-14 | Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a… |
CVE-2026-82784 | Medium | 6.5 | 2026-09-14 | Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API wi… |
CVE-2026-90620 | High | 7.3 | 2026-09-14 | A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file he… |
CVE-2026-90579 | High | 7.3 | 2026-09-13 | A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custo… |
CVE-2026-90524 | High | 7.3 | 2026-09-13 | A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unkn… |
CVE-2026-90513 | Medium | 6.5 | 2026-09-13 | A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of t… |
CVE-2026-90504 | High | 7.3 | 2026-09-13 | A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The… |
CVE-2026-90543 | Medium | 5.3 | 2026-09-12 | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in pl… |
CVE-2026-90449 | Medium | 6.5 | 2026-09-11 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that in… |
CVE-2026-50025 | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… | |
CVE-2026-53952 | Critical | 9.8 | 2026-09-11 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below… |
CVE-2026-89263 | Medium | 5.3 | 2026-09-11 | MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email no… |
CVE-2026-89261 | Medium | 6.5 | 2026-09-11 | MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, r… |
CVE-2026-80462 | Critical | 10.0 | 2026-09-11 | A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Auto… |
CVE-2026-89250 | High | 7.5 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint tha… |
CVE-2026-89176 | High | 8.8 | 2026-09-11 | WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the sa… |
CVE-2026-88062 | | 2026-09-10 | OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents cust… | |
CVE-2026-9336 | Medium | 6.5 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative end… |
CVE-2026-88018 | Critical | 9.8 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with… |
CVE-2026-88285 | Critical | 9.4 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and iss… |
CVE-2026-67593 | Critical | 9.1 | 2026-09-10 | A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authenticat… |
CVE-2026-57967 | Critical | 9.8 | 2026-09-10 | An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previousl… |
CVE-2026-49364 | Critical | 9.1 | 2026-09-10 | An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handsha… |
CVE-2026-49363 | High | 7.5 | 2026-09-10 | An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authent… |
CVE-2026-49362 | High | 7.5 | 2026-09-10 | An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential d… |
CVE-2026-87924 | Medium | 6.5 | 2026-09-09 | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part… |
CVE-2026-87922 | High | 7.3 | 2026-09-09 | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is t… |
CVE-2026-77974 | High | 8.0 | 2026-09-09 | After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated… |
CVE-2026-79961 | Medium | 5.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical F… |
CVE-2026-11838 | Medium | 4.3 | 2026-09-09 | Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc… |
CVE-2026-85981 | Medium | 6.7 | 2026-09-08 | The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication… |
CVE-2026-86808 | High | 7.3 | 2026-09-08 | A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_han… |
CVE-2026-86464 | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… | |
CVE-2026-83991 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally. |
CVE-2026-73004 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally. |
CVE-2026-72964 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally. |
CVE-2026-69674 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally. |