CWE-306 · Missing Authentication for Critical Function (page 8)
Page 8 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42303 | | 2026-05-12 | Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplic… | |
CVE-2026-31245 | Medium | 5.3 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticate… |
CVE-2026-31244 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows… |
CVE-2026-31243 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memor… |
CVE-2026-31242 | Critical | 9.1 | 2026-05-12 | The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unau… |
CVE-2026-31241 | Medium | 6.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthentica… |
CVE-2026-31240 | High | 7.5 | 2026-05-12 | The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory recor… |
CVE-2026-5029 | | 2026-05-12 | A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint with… | |
CVE-2026-22924 | Critical | 9.1 | 2026-05-12 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections a… |
CVE-2026-43881 | Medium | 5.3 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/users.json.php exposes two unauthenticated paths that disclose the… |
CVE-2026-42864 | Critical | 9.9 | 2026-05-11 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable withou… |
CVE-2026-44413 | High | 8.2 | 2026-05-11 | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access |
CVE-2026-42856 | | 2026-05-11 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication… | |
CVE-2026-42312 | Medium | 6.8 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i… |
CVE-2021-47940 | Critical | 9.8 | 2026-05-10 | WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload m… |
CVE-2021-47936 | Critical | 9.8 | 2026-05-10 | OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP fi… |
CVE-2021-47933 | Critical | 9.8 | 2026-05-10 | WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requ… |
CVE-2026-42569 | Critical | 9.4 | 2026-05-09 | phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a lega… |
CVE-2026-8185 | Medium | 6.3 | 2026-05-09 | A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface… |
CVE-2026-42302 | Critical | 9.8 | 2026-05-08 | FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of FastGPT is vulnerable to unauthenticat… |
CVE-2026-42176 | Medium | 6.7 | 2026-05-08 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/c… |
CVE-2026-44338 | High | 7.3 | 2026-05-08 | PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by… |
CVE-2026-6736 | Medium | 6.5 | 2026-05-07 | An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypa… |
CVE-2026-7415 | Critical | 9.8 | 2026-05-07 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read or write ACLs. Any host on the same net… |
CVE-2026-8031 | Medium | 5.3 | 2026-05-06 | A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/pa… |
CVE-2026-41930 | Critical | 9.8 | 2026-05-06 | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attack… |
CVE-2026-7844 | Medium | 6.3 | 2026-05-05 | A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retriev… |
CVE-2026-36356 | Critical | 9.1 | 2026-05-05 | The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /actio… |
CVE-2023-54344 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by se… |
CVE-2023-54342 | Critical | 9.8 | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to… |
CVE-2026-42222 | High | 8.1 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial instal… |
CVE-2026-42221 | High | 8.1 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initia… |
CVE-2026-42796 | Critical | 9.8 | 2026-05-04 | Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query paramet… |
CVE-2026-7723 | High | 7.3 | 2026-05-04 | A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Execut… |
CVE-2026-7714 | Medium | 6.5 | 2026-05-04 | A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functionality of the file cps/cwa_functions.p… |
CVE-2026-39858 | Critical | 10.0 | 2026-04-30 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerabi… |
CVE-2026-35514 | Medium | 6.5 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint P… |
CVE-2025-13030 | High | 7.1 | 2026-04-30 | All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload… |
CVE-2026-0204 | High | 8.0 | 2026-04-29 | A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. |
CVE-2026-41940 | Critical | 9.8 | 2026-04-29 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unaut… |
CVE-2026-3893 | Critical | 9.4 | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration… |
CVE-2026-5944 | High | 8.2 | 2026-04-28 | An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endp… |
CVE-2026-3323 | High | 7.5 | 2026-04-28 | An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials… |
CVE-2024-54013 | High | 8.8 | 2026-04-28 | Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain condi… |
CVE-2026-7113 | Medium | 5.6 | 2026-04-27 | A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of… |
CVE-2026-7042 | High | 7.3 | 2026-04-26 | A flaw has been found in 666ghj MiroFish up to 0.1.2. This affects the function create_app of the file backend/app/__init__.py of the component REST API Endpoi… |
CVE-2026-41473 | Critical | 9.1 | 2026-04-24 | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote att… |
CVE-2026-41477 | High | 7.8 | 2026-04-24 | Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAcces… |
CVE-2026-42095 | Medium | 4.0 | 2026-04-24 | bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL. |
CVE-2026-6272 | | 2026-04-24 | A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending Pro… | |
CVE-2026-40620 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or aut… |
CVE-2026-35064 | High | 7.5 | 2026-04-24 | A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the vendor’s management protocol, enabling… |
CVE-2026-27843 | Critical | 9.1 | 2026-04-24 | A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentica… |
CVE-2026-25775 | Critical | 9.8 | 2026-04-24 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or author… |
CVE-2026-6376 | | 2026-04-23 | A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentica… | |
CVE-2026-41273 | High | 8.2 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerabilit… |
CVE-2026-23751 | Critical | 9.8 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 24… |
CVE-2026-41179 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1… |
CVE-2026-41176 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without… |
CVE-2018-25259 | High | 8.4 | 2026-04-22 | Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allows local attackers to execute arbitrary… |
CVE-2026-5749 | | 2026-04-22 | Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT token with which to interac… | |
CVE-2026-40344 | High | 8.2 | 2026-04-22 | MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass… |
CVE-2026-34289 | Medium | 5.9 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34288 | Medium | 5.9 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34286 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34285 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2… |
CVE-2026-34280 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Manager). The supported version that is a… |
CVE-2026-34279 | Critical | 9.1 | 2026-04-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are a… |
CVE-2026-34275 | Critical | 9.8 | 2026-04-21 | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administration). Supported versions that are a… |
CVE-2026-34266 | Medium | 6.5 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supported version that is… |
CVE-2026-40884 | Critical | 9.8 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth sy… |
CVE-2026-40050 | Critical | 9.8 | 2026-04-21 | CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability o… |
CVE-2026-24177 | High | 7.7 | 2026-04-21 | NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability mi… |
CVE-2026-41039 | High | 7.5 | 2026-04-21 | This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based management interface. A… |
CVE-2026-34839 | Medium | 6.5 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessi… |
CVE-2026-26944 | High | 8.8 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-25058 | High | 7.5 | 2026-04-20 | Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service expo… |
CVE-2026-6369 | Medium | 5.5 | 2026-04-20 | An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive… |
CVE-2026-32962 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue. The device configuration may be alter… |
CVE-2026-32957 | Medium | 5.3 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware maintenance. Arbitrary fil… |
CVE-2026-6588 | Medium | 6.5 | 2026-04-20 | A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/rout… |
CVE-2026-6582 | High | 7.3 | 2026-04-19 | A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controller… |
CVE-2026-6579 | Medium | 6.5 | 2026-04-19 | A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endp… |
CVE-2026-6577 | High | 7.3 | 2026-04-19 | A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the comp… |
CVE-2026-40461 | High | 7.5 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes th… |
CVE-2026-35546 | Critical | 9.8 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execut… |
CVE-2026-6348 | High | 8.8 | 2026-04-16 | WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrary code wi… |
CVE-2026-34160 | High | 8.6 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at… |
CVE-2026-33715 | High | 7.2 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authenticat… |
CVE-2026-26160 | High | 7.8 | 2026-04-14 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-26159 | High | 7.8 | 2026-04-14 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53847 | Medium | 6.5 | 2026-04-14 | A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11… |
CVE-2026-40289 | Critical | 9.1 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is… |
CVE-2026-4810 | | 2026-04-13 | A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) versions 1.7.0 (and 2.0.0a1) through 1.28.1 (and 2.0.0a2) on Py… | |
CVE-2026-6129 | High | 7.3 | 2026-04-12 | A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performi… |
CVE-2026-6126 | High | 7.3 | 2026-04-12 | A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP E… |
CVE-2026-5724 | | 2026-04-10 | The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary R… | |
CVE-2026-40184 | Low | 3.7 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2. |
CVE-2026-5777 | | 2026-04-10 | This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service over the local network without authentica… | |
CVE-2026-39848 | Medium | 6.5 | 2026-04-09 | Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF prote… |