CWE-306 · Missing Authentication for Critical Function (page 5)
Page 5 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-16210 | High | 7.3 | 2026-07-19 | A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin… |
CVE-2026-16209 | High | 7.3 | 2026-07-19 | A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Pro… |
CVE-2026-8505 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of a… |
CVE-2026-9103 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login… |
CVE-2026-9202 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true… |
CVE-2026-63101 | High | 7.5 | 2026-07-17 | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of… |
CVE-2026-12691 | High | 7.5 | 2026-07-17 | Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterpr… |
CVE-2026-63098 | Medium | 5.3 | 2026-07-17 | TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configurati… |
CVE-2026-16015 | Medium | 6.3 | 2026-07-17 | A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/ta… |
CVE-2026-62241 | Critical | 9.1 | 2026-07-17 | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default… |
CVE-2024-34268 | High | 7.1 | 2026-07-16 | EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This v… |
CVE-2026-6511 | Medium | 5.5 | 2026-07-16 | During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a… |
CVE-2026-63087 | Critical | 9.8 | 2026-07-16 | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POS… |
CVE-2026-57206 | High | 8.6 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin va… |
CVE-2026-45695 | Critical | 9.8 | 2026-07-16 | Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data ded… |
CVE-2026-46339 | Critical | 10.0 | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing un… |
CVE-2026-58658 | High | 8.2 | 2026-07-15 | GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to acce… |
CVE-2026-53512 | Critical | 9.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoint… |
CVE-2026-61613 | | 2026-07-15 | Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker… | |
CVE-2026-48325 | Critical | 9.3 | 2026-07-14 | ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-24259 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of th… |
CVE-2026-24229 | High | 7.3 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal clu… |
CVE-2026-48252 | High | 8.6 | 2026-07-14 | Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacke… |
CVE-2026-47212 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doP… |
CVE-2026-45755 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse()… |
CVE-2026-45754 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridg… |
CVE-2026-50451 | High | 7.1 | 2026-07-14 | Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50444 | High | 8.8 | 2026-07-14 | Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network. |
CVE-2026-57969 | High | 8.8 | 2026-07-14 | Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56164 | Medium | 5.3 | 2026-07-14 | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-50333 | High | 7.8 | 2026-07-14 | Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-49174 | Medium | 6.1 | 2026-07-14 | Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-10577 | | 2026-07-14 | A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper pr… | |
CVE-2026-62422 | Critical | 10.0 | 2026-07-14 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database… |
CVE-2026-58319 | Critical | 9.1 | 2026-07-14 | Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE… |
CVE-2026-15416 | High | 8.9 | 2026-07-14 | A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the A… |
CVE-2026-62327 | Critical | 9.1 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for… |
CVE-2026-59801 | Critical | 9.8 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints… |
CVE-2026-6847 | | 2026-07-13 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endp… | |
CVE-2026-22096 | | 2026-07-13 | The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading fi… | |
CVE-2026-15491 | High | 7.3 | 2026-07-12 | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation caus… |
CVE-2026-55884 | | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla… | |
CVE-2026-57476 | Medium | 4.8 | 2026-07-10 | Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject c… |
CVE-2026-57475 | Medium | 5.3 | 2026-07-10 | Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited addit… |
CVE-2026-56675 | High | 8.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host r… |
CVE-2026-38059 | High | 7.5 | 2026-07-10 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve s… |
CVE-2026-40006 | High | 7.5 | 2026-07-10 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability i… |
CVE-2026-58123 | Critical | 9.8 | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands b… |
CVE-2026-55605 | Medium | 5.3 | 2026-07-09 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of `@arikusi/deepsee… |
CVE-2026-59148 | High | 8.8 | 2026-07-09 | Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Exp… |
CVE-2026-0283 | High | 7.2 | 2026-07-09 | An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access t… |
CVE-2026-61344 | Medium | 5.3 | 2026-07-09 | The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exposes an API endpoint that returns court reminder records containi… |
CVE-2026-59726 | Critical | 10.0 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST… |
CVE-2026-59715 | Low | 3.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always… |
CVE-2026-15192 | Medium | 6.5 | 2026-07-09 | A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhoo… |
CVE-2026-31983 | Medium | 5.3 | 2026-07-09 | A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys… |
CVE-2026-54776 | Medium | 4.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain… |
CVE-2026-44025 | High | 7.5 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agen… |
CVE-2026-59822 | High | 8.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauth… |
CVE-2026-59804 | Medium | 6.8 | 2026-07-08 | Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthent… |
CVE-2026-15063 | Medium | 6.3 | 2026-07-08 | A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes… |
CVE-2026-54061 | Critical | 9.1 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public g… |
CVE-2026-59705 | Critical | 9.8 | 2026-07-07 | mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary use… |
CVE-2026-51937 | High | 7.5 | 2026-07-07 | An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAcces… |
CVE-2026-59706 | Critical | 9.3 | 2026-07-07 | mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_b… |
CVE-2026-58473 | Critical | 9.1 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration… |
CVE-2026-49471 | High | 8.3 | 2026-07-07 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes… |
CVE-2026-53647 | | 2026-07-07 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is ac… | |
CVE-2026-41899 | Medium | 6.5 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authenti… |
CVE-2026-42341 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in F… | |
CVE-2026-42331 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorizat… | |
CVE-2026-53913 | Critical | 9.8 | 2026-07-06 | Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. … |
CVE-2026-14714 | Medium | 6.5 | 2026-07-05 | A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common… |
CVE-2026-14622 | High | 7.3 | 2026-07-04 | A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code o… |
CVE-2026-10054 | High | 8.8 | 2026-07-03 | In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /service… |
CVE-2026-4767 | Critical | 9.8 | 2026-07-02 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v… |
CVE-2026-13125 | High | 8.8 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision soft… |
CVE-2026-58127 | Critical | 9.8 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemot… |
CVE-2026-58126 | Critical | 9.8 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by expl… |
CVE-2026-56286 | High | 8.1 | 2026-06-30 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication… |
CVE-2026-58446 | Medium | 6.5 | 2026-06-30 | Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is r… |
CVE-2026-58375 | High | 7.5 | 2026-06-30 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTo… |
CVE-2026-44949 | | 2026-06-30 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0… | |
CVE-2026-14162 | Critical | 9.8 | 2026-06-30 | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific… |
CVE-2026-12819 | | 2026-06-30 | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interacti… | |
CVE-2026-56782 | Critical | 9.8 | 2026-06-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access… |
CVE-2026-13546 | High | 7.3 | 2026-06-29 | A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Perfo… |
CVE-2026-50136 | High | 7.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned… |
CVE-2026-43920 | | 2026-06-26 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling… | |
CVE-2026-40702 | Critical | 9.4 | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weaknes… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2026-54088 | | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the H… | |
CVE-2026-54040 | Medium | 5.9 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates a… |
CVE-2026-54036 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authe… |
CVE-2026-4522 | | 2026-06-25 | Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. This issue affects HYPR Passwordle… | |
CVE-2026-12490 | High | 7.5 | 2026-06-25 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client cert… |
CVE-2026-54068 | Medium | 5.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication… |
CVE-2026-33543 | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intende… | |
CVE-2026-1840 | High | 7.5 | 2026-06-24 | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This… |