CWE-306 · Missing Authentication for Critical Function (page 5)
Page 5 of 35 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65105 | High | 8.1 | 2026-08-25 | NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service without authenticati… |
CVE-2026-55571 | High | 8.2 | 2026-08-25 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount se… |
CVE-2026-55640 | Critical | 9.1 | 2026-08-25 | Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpo… |
CVE-2026-55539 | High | 8.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable… |
CVE-2026-55533 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT a… |
CVE-2026-55538 | High | 7.3 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authentic… |
CVE-2026-55534 | High | 8.6 | 2026-08-25 | PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authent… |
CVE-2026-55529 | Medium | 6.9 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so… |
CVE-2026-55528 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not chec… |
CVE-2026-79668 | Medium | 5.3 | 2026-08-25 | Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment eng… |
CVE-2026-57910 | | 2026-08-25 | Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevat… | |
CVE-2026-57909 | | 2026-08-25 | A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected sy… | |
CVE-2026-67578 | High | 7.5 | 2026-08-25 | FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings… |
CVE-2026-78434 | Medium | 6.5 | 2026-08-24 | A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpde… |
CVE-2026-77915 | Critical | 9.8 | 2026-08-24 | rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Admi… |
CVE-2026-78369 | | 2026-08-24 | RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for… | |
CVE-2026-6017 | | 2026-08-24 | Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to… | |
CVE-2026-78306 | | 2026-08-24 | DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration paramet… | |
CVE-2026-78255 | | 2026-08-24 | The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames… | |
CVE-2026-19853 | Medium | 5.3 | 2026-08-24 | NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality t… |
CVE-2026-59808 | High | 8.8 | 2026-08-22 | AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any vi… |
CVE-2026-48106 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/rep… | |
CVE-2026-48050 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.U… | |
CVE-2026-34949 | Medium | 6.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file creat… |
CVE-2026-34741 | High | 8.6 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP… |
CVE-2026-69228 | Medium | 5.3 | 2026-08-21 | There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a… |
CVE-2026-30866 | High | 7.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has bee… |
CVE-2026-15576 | | 2026-08-21 | Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verificati… | |
CVE-2026-19441 | Medium | 5.3 | 2026-08-21 | Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush: through 21082… |
CVE-2026-76137 | Low | 3.3 | 2026-08-21 | Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Ed… |
CVE-2026-76157 | | 2026-08-21 | Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticate… | |
CVE-2026-77644 | | 2026-08-20 | A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition. | |
CVE-2026-49217 | High | 7.5 | 2026-08-20 | Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthentic… |
CVE-2025-52182 | High | 7.5 | 2026-08-20 | The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability. |
CVE-2026-9033 | Medium | 4.3 | 2026-08-20 | An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including for… |
CVE-2026-55642 | Critical | 9.8 | 2026-08-20 | dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to… |
CVE-2026-18265 | Critical | 9.8 | 2026-08-20 | OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-15706 | Critical | 9.8 | 2026-08-20 | Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (B… |
CVE-2026-14952 | High | 7.5 | 2026-08-20 | An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under… |
CVE-2026-76355 | High | 7.5 | 2026-08-19 | In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations thr… |
CVE-2026-63722 | Critical | 9.8 | 2026-08-19 | ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining… |
CVE-2026-19875 | High | 7.5 | 2026-08-19 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due… |
CVE-2026-72529 | Critical | 9.8 | 2026-08-19 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie… |
CVE-2026-20357 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-75919 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and c… |
CVE-2026-71068 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. D… |
CVE-2026-71067 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. E… |
CVE-2026-71015 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller)… |
CVE-2026-70979 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). T… |
CVE-2026-70977 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). T… |
CVE-2026-70973 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version… |
CVE-2026-70956 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version… |
CVE-2026-70954 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is… |
CVE-2026-70953 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is… |
CVE-2026-70940 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70930 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected ar… |
CVE-2026-70926 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12… |
CVE-2026-70924 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected… |
CVE-2026-70918 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Outbound Data). Supported versions that are affected are 12.2.3-12.2.15… |
CVE-2026-70861 | High | 7.2 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is… |
CVE-2026-70806 | High | 7.1 | 2026-08-18 | Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-70805 | High | 8.1 | 2026-08-18 | Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management). Supported versions that are affect… |
CVE-2026-70711 | Low | 3.6 | 2026-08-18 | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-70693 | Medium | 6.3 | 2026-08-18 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported… |
CVE-2026-61307 | High | 8.1 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported… |
CVE-2026-60975 | High | 7.5 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61 and… |
CVE-2026-60967 | High | 8.8 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision). Supported versions that are affected are 8.61-8.63… |
CVE-2026-60902 | High | 7.0 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo). Supported versions that are affected are 8.61-8.63. D… |
CVE-2026-60884 | Medium | 4.4 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2026-60883 | High | 7.2 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PeopleCode). Supported versions that are affected are 8.61-8.6… |
CVE-2026-60879 | High | 8.8 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Configuration Manager). Supported versions that are affected a… |
CVE-2026-60858 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-60856 | High | 7.4 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packaging). Supported versions that are affected a… |
CVE-2026-60831 | High | 8.1 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are… |
CVE-2026-60821 | Critical | 9.8 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are… |
CVE-2026-60782 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-60781 | High | 7.1 | 2026-08-18 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-60769 | High | 7.5 | 2026-08-18 | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60765 | High | 7.5 | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Difficul… |
CVE-2026-60751 | High | 8.8 | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.6. Easily e… |
CVE-2026-60742 | High | 8.1 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are… |
CVE-2026-60731 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-60722 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60721 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60720 | Critical | 9.9 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60716 | High | 8.8 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-60698 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60696 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60682 | Medium | 6.5 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.2… |
CVE-2026-60672 | Critical | 9.8 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-60591 | Critical | 9.1 | 2026-08-18 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 1… |
CVE-2026-52480 | Medium | 6.5 | 2026-08-18 | An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service |
CVE-2026-71878 | | 2026-08-18 | Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4… | |
CVE-2026-75854 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read… |
CVE-2026-75852 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue i… |
CVE-2026-56677 | High | 8.6 | 2026-08-17 | 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-contr… |
CVE-2026-75479 | High | 7.5 | 2026-08-17 | JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate al… |
CVE-2026-67966 | Critical | 9.8 | 2026-08-17 | Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access. |
CVE-2026-75060 | High | 8.4 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools |
CVE-2026-71566 | Critical | 9.3 | 2026-08-17 | FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. H… |