CWE-306 · Missing Authentication for Critical Function (page 4)
Page 4 of 35 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69674 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to bypass a security feature locally. |
CVE-2026-69554 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. |
CVE-2026-69528 | High | 7.8 | 2026-09-08 | Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-69415 | Medium | 6.8 | 2026-09-08 | Missing authentication for critical function in Windows DHCP Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69321 | Medium | 5.5 | 2026-09-08 | Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally. |
CVE-2026-86728 | High | 7.5 | 2026-09-08 | AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to… |
CVE-2026-86727 | High | 7.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream key… |
CVE-2026-77097 | High | 8.2 | 2026-09-08 | Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade… |
CVE-2026-62645 | Critical | 9.8 | 2026-09-08 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the… |
CVE-2026-19397 | | 2026-09-08 | Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct conn… | |
CVE-2026-86543 | Critical | 9.8 | 2026-09-07 | knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installa… |
CVE-2026-86506 | Medium | 5.9 | 2026-09-07 | In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data |
CVE-2026-86502 | High | 8.4 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts |
CVE-2026-86486 | Low | 3.7 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank |
CVE-2026-86480 | Critical | 9.8 | 2026-09-07 | In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges |
CVE-2026-79645 | High | 8.2 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical F… |
CVE-2026-78480 | High | 7.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical F… |
CVE-2026-80132 | High | 8.1 | 2026-09-07 | ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Fu… |
CVE-2026-76578 | Critical | 9.8 | 2026-09-07 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the t… |
CVE-2026-86293 | Medium | 6.5 | 2026-09-07 | A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.p… |
CVE-2026-86292 | High | 7.3 | 2026-09-07 | A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component Use… |
CVE-2026-16876 | | 2026-09-07 | An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands… | |
CVE-2026-86259 | High | 7.5 | 2026-09-06 | OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadat… |
CVE-2026-86242 | High | 8.1 | 2026-09-06 | Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authen… |
CVE-2026-67277 | High | 8.2 | 2026-09-05 | RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this sta… |
CVE-2026-86184 | Critical | 9.8 | 2026-09-05 | Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate… |
CVE-2026-86124 | Critical | 9.8 | 2026-09-05 | AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied command… |
CVE-2026-86121 | Critical | 9.8 | 2026-09-05 | Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, all… |
CVE-2026-85702 | High | 7.3 | 2026-09-04 | A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation… |
CVE-2026-85701 | Medium | 5.3 | 2026-09-04 | A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.cre… |
CVE-2026-79391 | Critical | 9.8 | 2026-09-04 | No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication… |
CVE-2026-85637 | Medium | 5.3 | 2026-09-04 | A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Ad… |
CVE-2026-9317 | High | 8.1 | 2026-09-04 | Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaSc… |
CVE-2026-85636 | Medium | 5.3 | 2026-09-04 | A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Log… |
CVE-2026-75430 | Critical | 9.8 | 2026-09-04 | PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport p… |
CVE-2026-17057 | Medium | 6.5 | 2026-09-04 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical fu… |
CVE-2026-85695 | Critical | 9.4 | 2026-09-04 | FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker ad… |
CVE-2026-85688 | Critical | 9.8 | 2026-09-04 | TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can sub… |
CVE-2026-85671 | High | 7.5 | 2026-09-04 | QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows un… |
CVE-2026-85667 | Critical | 9.1 | 2026-09-04 | xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary me… |
CVE-2026-85663 | Critical | 9.8 | 2026-09-04 | Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated… |
CVE-2026-75754 | | 2026-09-04 | Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorize… | |
CVE-2026-85428 | Critical | 9.8 | 2026-09-03 | MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write v… |
CVE-2026-85424 | Critical | 9.8 | 2026-09-03 | MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database… |
CVE-2026-70352 | Critical | 10.0 | 2026-09-03 | Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-84831 | | 2026-09-03 | SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker… | |
CVE-2026-84452 | | 2026-09-02 | Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serv… | |
CVE-2026-84840 | Medium | 6.5 | 2026-09-02 | A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstra… |
CVE-2026-84839 | Medium | 5.3 | 2026-09-02 | A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component… |
CVE-2026-53649 | Critical | 9.6 | 2026-09-02 | Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication a… |
CVE-2025-15481 | Medium | 5.3 | 2026-09-02 | The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails. |
CVE-2024-35585 | High | 8.6 | 2026-09-02 | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. |
CVE-2026-84485 | High | 7.5 | 2026-09-02 | APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve m… |
CVE-2026-84700 | High | 8.6 | 2026-09-02 | PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client por… |
CVE-2026-84696 | High | 8.2 | 2026-09-02 | Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authe… |
CVE-2026-84423 | High | 7.3 | 2026-09-01 | A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource AP… |
CVE-2026-73726 | Medium | 6.8 | 2026-09-01 | A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjace… |
CVE-2026-73710 | High | 8.2 | 2026-09-01 | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Succ… |
CVE-2026-73706 | High | 8.6 | 2026-09-01 | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change… |
CVE-2026-79687 | Critical | 9.0 | 2026-09-01 | Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially e… |
CVE-2026-18771 | High | 7.5 | 2026-09-01 | Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentic… |
CVE-2026-12663 | | 2026-09-01 | A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This co… | |
CVE-2026-82919 | High | 7.3 | 2026-08-31 | A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit… |
CVE-2026-82906 | Low | 3.7 | 2026-08-31 | A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of… |
CVE-2026-54598 | High | 7.5 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations whe… |
CVE-2026-75133 | High | 7.5 | 2026-08-31 | Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a… |
CVE-2026-66047 | High | 8.1 | 2026-08-31 | ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attack… |
CVE-2026-82695 | Critical | 10.0 | 2026-08-31 | A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The… |
CVE-2026-82694 | Critical | 10.0 | 2026-08-31 | A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web… |
CVE-2026-82693 | Critical | 10.0 | 2026-08-31 | A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web… |
CVE-2026-58574 | Critical | 9.8 | 2026-08-31 | Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted manage… |
CVE-2026-82641 | High | 8.6 | 2026-08-30 | Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints th… |
CVE-2026-82473 | High | 8.2 | 2026-08-29 | KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on po… |
CVE-2026-82472 | High | 7.5 | 2026-08-29 | Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Un… |
CVE-2026-82452 | Critical | 9.8 | 2026-08-29 | rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handle… |
CVE-2026-55678 | | 2026-08-28 | Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without auth… | |
CVE-2026-82282 | High | 8.0 | 2026-08-28 | Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers ca… |
CVE-2026-82277 | Critical | 9.8 | 2026-08-28 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protectio… |
CVE-2026-82276 | Medium | 5.3 | 2026-08-28 | StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing… |
CVE-2026-82266 | Critical | 9.8 | 2026-08-28 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. A… |
CVE-2026-82265 | Medium | 6.5 | 2026-08-28 | Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensit… |
CVE-2026-78239 | Critical | 9.8 | 2026-08-28 | Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative servic… |
CVE-2026-77977 | High | 8.1 | 2026-08-28 | Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default c… |
CVE-2026-73125 | Critical | 9.8 | 2026-08-28 | Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated… |
CVE-2026-68929 | | 2026-08-28 | FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoint… | |
CVE-2026-76640 | High | 7.5 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated p… |
CVE-2026-76639 | High | 8.8 | 2026-08-27 | Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitra… |
CVE-2026-81735 | Critical | 10.0 | 2026-08-27 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSe… |
CVE-2026-81664 | Medium | 5.3 | 2026-08-27 | The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.De… |
CVE-2026-81098 | Critical | 9.1 | 2026-08-27 | The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the… |
CVE-2026-81094 | Critical | 9.1 | 2026-08-27 | The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/… |
CVE-2026-80208 | High | 8.2 | 2026-08-27 | APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterce… |
CVE-2026-80207 | Medium | 5.3 | 2026-08-27 | APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation… |
CVE-2026-65956 | | 2026-08-26 | KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same publ… | |
CVE-2026-81202 | High | 7.3 | 2026-08-26 | A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component… |
CVE-2026-75329 | Critical | 9.8 | 2026-08-26 | The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the fu… |
CVE-2026-75601 | Medium | 4.3 | 2026-08-26 | Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics fe… |
CVE-2026-47837 | Medium | 6.8 | 2026-08-26 | Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpo… |
CVE-2026-81032 | Critical | 9.8 | 2026-08-26 | NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp… |
CVE-2026-80234 | Medium | 5.3 | 2026-08-26 | CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists… |