CWE-306 · Missing Authentication for Critical Function (page 9)
Page 9 of 30 — CVEs classified under CWE-306, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33788 | High | 7.8 | 2026-04-09 | A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows… |
CVE-2026-4436 | High | 8.6 | 2026-04-09 | A low-privileged remote attacker can send Modbus packets to manipulate register values that are inputs to the odorant injection logic such that too much or t… |
CVE-2026-39987 | Critical | 9.8 | 2026-04-09 | marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authenticati… |
CVE-2025-30650 | Medium | 6.7 | 2026-04-08 | A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain acce… |
CVE-2026-39393 | High | 8.1 | 2026-04-08 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0… |
CVE-2026-5300 | Medium | 5.9 | 2026-04-08 | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP r… |
CVE-2026-39363 | High | 7.5 | 2026-04-07 | Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSoc… |
CVE-2026-35584 | Medium | 6.5 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id… |
CVE-2026-35523 | High | 7.5 | 2026-04-07 | Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscript… |
CVE-2026-22679 | Critical | 9.8 | 2026-04-07 | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboA… |
CVE-2026-1900 | Medium | 6.5 | 2026-04-07 | The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates. |
CVE-2026-35450 | Medium | 5.3 | 2026-04-06 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configu… |
CVE-2026-5676 | High | 7.3 | 2026-04-06 | A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such man… |
CVE-2026-26027 | High | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory e… |
CVE-2026-5632 | High | 7.3 | 2026-04-06 | A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a man… |
CVE-2026-5616 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jee… |
CVE-2026-4272 | High | 8.1 | 2026-04-05 | Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: fro… |
CVE-2019-25686 | High | 7.5 | 2026-04-05 | Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a m… |
CVE-2019-25678 | High | 8.2 | 2026-04-05 | C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL comma… |
CVE-2018-25246 | High | 7.5 | 2026-04-04 | Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through… |
CVE-2018-25241 | High | 7.5 | 2026-04-04 | VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input th… |
CVE-2026-34952 | Critical | 9.1 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology a… |
CVE-2026-32646 | High | 7.5 | 2026-04-03 | A specific administrative endpoint is accessible without proper authentication, exposing device management functions. |
CVE-2026-28767 | Medium | 5.3 | 2026-04-03 | A specific administrative endpoint notifications is accessible without proper authentication. |
CVE-2026-28766 | Critical | 9.3 | 2026-04-03 | A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication. |
CVE-2026-0545 | Critical | 9.8 | 2026-04-03 | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enab… |
CVE-2026-32211 | Critical | 9.1 | 2026-04-03 | Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-15620 | High | 8.6 | 2026-04-02 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows re… |
CVE-2026-35053 | Critical | 9.8 | 2026-04-02 | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoint… |
CVE-2026-34758 | Critical | 9.1 | 2026-04-02 | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number manag… |
CVE-2026-33951 | High | 7.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTT… |
CVE-2026-29132 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protec… |
CVE-2026-5320 | High | 7.3 | 2026-04-02 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the compon… |
CVE-2026-21767 | Medium | 4.0 | 2026-04-02 | HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper… |
CVE-2026-34072 | High | 8.3 | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentica… |
CVE-2025-67805 | Medium | 5.9 | 2026-04-01 | A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensiti… |
CVE-2026-34999 | Medium | 5.3 | 2026-04-01 | OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers t… |
CVE-2026-4370 | Critical | 10.0 | 2026-04-01 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to pe… |
CVE-2026-34732 | Medium | 5.3 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authenticatio… |
CVE-2026-34731 | High | 7.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated use… |
CVE-2026-1579 | Critical | 9.8 | 2026-03-31 | The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message --… |
CVE-2026-3356 | | 2026-03-31 | The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface… | |
CVE-2026-34227 | High | 8.8 | 2026-03-31 | Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenti… |
CVE-2026-34200 | High | 7.5 | 2026-03-31 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network… |
CVE-2026-34162 | Critical | 10.0 | 2026-03-31 | FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed witho… |
CVE-2026-33032 | Critical | 9.8 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP… |
CVE-2026-34472 | High | 7.1 | 2026-03-30 | Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local n… |
CVE-2026-5000 | High | 7.3 | 2026-03-28 | A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file bac… |
CVE-2018-25225 | High | 8.4 | 2026-03-28 | SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious inpu… |
CVE-2018-25224 | High | 8.4 | 2026-03-28 | PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious valu… |
CVE-2026-34411 | Medium | 5.3 | 2026-03-27 | Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /… |
CVE-2026-4959 | High | 7.3 | 2026-03-27 | A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the compone… |
CVE-2026-33366 | Medium | 5.3 | 2026-03-27 | Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authen… |
CVE-2026-3527 | Medium | 6.5 | 2026-03-26 | Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24068 | High | 8.8 | 2026-03-26 | The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to v… |
CVE-2026-1724 | Medium | 6.8 | 2026-03-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowe… |
CVE-2026-32326 | Medium | 5.7 | 2026-03-25 | SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password o… |
CVE-2026-2417 | | 2026-03-24 | A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated a… | |
CVE-2026-33159 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest user… |
CVE-2026-33340 | Critical | 9.1 | 2026-03-24 | LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability ha… |
CVE-2019-25632 | Medium | 6.2 | 2026-03-24 | phpFileManager 1.7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the action, fm… |
CVE-2026-4649 | | 2026-03-24 | Apache Artemis before version 2.52.0 is affected by an authentication bypass flaw which allows reading all messages exchanged via the broker and injection of n… | |
CVE-2026-4640 | High | 7.5 | 2026-03-24 | Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain funct… |
CVE-2026-33719 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disab… |
CVE-2025-15517 | High | 8.1 | 2026-03-23 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
CVE-2026-31846 | Medium | 6.5 | 2026-03-23 | Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attac… |
CVE-2026-4582 | Medium | 5.0 | 2026-03-23 | A security vulnerability has been detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2026-4562 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component… |
CVE-2026-2756 | Medium | 5.0 | 2026-03-21 | A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipula… |
CVE-2019-25568 | Critical | 9.8 | 2026-03-21 | Memu Play 6.0.7 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by replacing the MemuService.exe exe… |
CVE-2026-32896 | Medium | 4.8 | 2026-03-21 | The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhoo… |
CVE-2026-32064 | High | 7.7 | 2026-03-21 | OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated ac… |
CVE-2026-33231 | High | 7.5 | 2026-03-20 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-33203 | High | 7.5 | 2026-03-20 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specifi… |
CVE-2026-29796 | Critical | 9.4 | 2026-03-20 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-25192 | Critical | 9.4 | 2026-03-20 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the bac… |
CVE-2026-22898 | Critical | 9.8 | 2026-03-20 | A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to ga… |
CVE-2026-33070 | Low | 3.7 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint… |
CVE-2026-4476 | Medium | 6.3 | 2026-03-20 | A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the c… |
CVE-2026-33038 | High | 8.1 | 2026-03-20 | WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfigura… |
CVE-2026-33017 | Critical | 9.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow end… |
CVE-2026-21992 | Critical | 9.8 | 2026-03-20 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracl… |
CVE-2026-32985 | Critical | 9.8 | 2026-03-20 | Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows… |
CVE-2026-22731 | High | 8.2 | 2026-03-19 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication… |
CVE-2026-32041 | Medium | 6.9 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessibl… |
CVE-2025-71257 | High | 7.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on re… |
CVE-2026-24062 | High | 7.8 | 2026-03-18 | The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. T… |
CVE-2026-2603 | High | 8.1 | 2026-03-18 | A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the… |
CVE-2026-22174 | Medium | 6.8 | 2026-03-18 | OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to… |
CVE-2026-22727 | High | 7.5 | 2026-03-17 | Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has by… |
CVE-2026-1264 | High | 7.1 | 2026-03-17 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a… |
CVE-2026-3207 | Critical | 9.8 | 2026-03-17 | Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access. |
CVE-2026-32297 | High | 7.5 | 2026-03-17 | The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration files or system binaries. Modified configuration… |
CVE-2026-32296 | High | 8.2 | 2026-03-17 | Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to… |
CVE-2026-32291 | Medium | 6.8 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM before 1.8.2 does not require authentication on the UART serial console. This attack requires physically opening the device and… |
CVE-2026-4312 | Critical | 9.8 | 2026-03-17 | GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain… |
CVE-2026-4187 | Medium | 5.3 | 2026-03-16 | A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInf… |
CVE-2026-3558 | High | 8.1 | 2026-03-16 | Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2026-32594 | High | 7.3 | 2026-03-16 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSock… |
CVE-2026-2491 | Medium | 6.3 | 2026-03-16 | Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected inst… |