CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- evmapaEVMAPA Missing Authentication for Critical Function9.4 Critical
- dragonflyoss dragonflyDragonfly Manager Job API Allows Unauthenticated Access8.9 High
- hamastar technology meetinghub, hamastar meetinghub paperless meetings +1 moreHAMASTAR Technology｜MeetingHub - Missing Authentication6.9 Medium
- dataease sqlbotSQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability7.7 High
- shenzhen tenda technology co.,ltd. tenda d151 & d301, tenda d151 firmware, d301 firmware +2 moreTenda D151 & D301 - Configuration Download8.7 High
- arcaneArcane allows unauthenticated proxy access to remote environments8.0 High
- mcpjam inspectorREC in MCPJam inspector due to HTTP Endpoint exposes9.8 Critical
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion5.3 Medium
- gotac statistics database systemGotac｜Statistics Database System - Missing Authentication8.7 High
- delta electronics diaviewDIAView - Authentication Bypass Vulnerability9.8 Critical
- denver sho-110Denver SHO-110 IP Camera Unauthenticated Snapshot Access8.7 High
- entrust corporation instant financial issuance (if)Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE9.3 Critical
- lenovo idea tab pro tb373fu, idea tab tb336fu, legion tab tb320fc +28 more +30 moreA potential missing authentication vulnerability was reported in some Lenovo Tablets that could...2.4 Low
- bluspark global bluvoyixAdministrator Account Creation Vulnerability in BLUVOYIX10.0 Critical
- extplorereXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)9.3 Critical
- microsoft sql server 2022 (gdr), sql server 2022 for x64-based systems (cu 22), sql server 2025 for x64-based systems (gdr) +2 more +4 moreMicrosoft SQL Server Elevation of Privilege Vulnerability7.2 High
- red hat openshift dev spaces (rhosds) 3.22, openshift dev spaces (rhosds) 3.23, openshift dev spaces (rhosds) 3.24 +2 moreGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/33339.0 Critical
- sap hana databasePrivilege escalation vulnerability in SAP HANA database8.8 High
- anoma opencodeOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution8.8 High
- smewebify weberpmesv2, wem-project wem +1 moreWebErpMesv2 allows unauthenticated API Access8.2 High
- flycatcher toys smart sketcherFlycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication5.3 Medium
- ruckus networks vriot iot controllerRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE10.0 Critical
- vivotek ip7137, ip7137 firmware +1 moreUnprotected RTSP stream in Vivotek IP7137 cameras8.7 High
- kaysus ks-wr3600 firmwareKAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the...8.4 High
- pandawireless pwru01 firmwareAn issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple...9.1 Critical
- dlink dir-605l firmwareAn issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6...6.8 Medium
- wolfssl wolfssl-pywolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement9.3 Critical
- flir systems, inc. thermal camera f/fc/pt/d streamFLIR Thermal Camera F/FC/PT/D Stream 8.0.0.64 Unauthenticated Stream Disclosure8.7 High
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by improper authentication and missing CSRF protection2.9 Low
- openflagr flagrOpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization9.3 Critical
- d-link dir-600, dir-608, dir-610 +14 more +16 moreD-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint9.3 Critical
- whill model c2 electric wheelchair, model f power chair +1 moreWHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for...9.3 Critical
- centreon awie, infra monitoring +1 moreUnauthenticated configuration import allows administrative account creation using AWIE component9.8 Critical
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API6.9 Medium
- bagistoBagisto Missing Authentication on Installer API Endpoints8.8 High
- langflowLangflow Missing Authentication on Critical API Endpoints8.8 High
- selea carplateserver (cps)Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint9.3 Critical
- the akuvox company akuvox smart intercom, akuvox c313w-2 firmware, nc-2 firmware +11 more +13 moreAkuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure8.7 High
- sound4 ltd. stream, kantar media wm2, sound4 big voice2 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure6.9 Medium
- pexip infinityPexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product...7.5 High
- mitsubishi electric europe smartrtuMitsubishi Electric Europe smartRTU Missing Authentication for Critical Function8.7 High
- beward n100 h.264 vga ip cameraBeward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure8.7 High
- rifatron co., ltd. dvrRifatron 5brid DVR 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504) Unauthenticated Live Stream Disclosure via animate.cgi8.7 High
- iseeq hybrid dvr wh-h4iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure8.7 High
- flir thermal traffic camerasFLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure8.7 High
- flir systems, inc. thermal traffic camerasFLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation9.3 Critical
- flir systems ax8 thermal camera, flir ax8 firmware +1 moreFLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure8.7 High
- flir systems, inc. brickstream 3d+FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure8.7 High
- flir systems, inc. brickstream 3d+FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure8.7 High
- synaccess networks inc. netbooter np-02x/np-08xSynaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi9.3 Critical
- Show moreLoading…