CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function8.7 High
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function9.3 Critical
- kde ariannabookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection...4.0 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing authentication for critical function9.2 Critical
- spicejet online booking systemMissing authentication for critical function in SpiceJet Online Booking System8.7 High
- tungsten automation capture (formerly kofax capture)Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting9.3 Critical
- lizardsystems terminal services managerTerminal Services Manager 3.1 Buffer Overflow SEH8.6 High
engramxnpmengram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection8.6 High- fullstepInadequate access control vulnerability in Fullstep8.7 High
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...5.9 Medium
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...5.9 Medium
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...9.1 Critical
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...9.1 Critical
- oracle peoplesoft enterprise hcm human resourcesVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft ...6.5 Medium
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...9.1 Critical
- oracle advanced inbound telephonyVulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite ...9.8 Critical
- oracle corporation peoplesoft enterprise hcm absence management, oracle peoplesoft enterprise human capital management absence management +1 moreVulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft ...6.5 Medium
- crowdstrike logscale self-hostedCrowdStrike LogScale Unauthenticated Path Traversal9.8 Critical
- nvidia kai schedulerNVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints...7.7 High
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 moreInformation Disclosure Vulnerability in Quantum Networks Router QN-I-4708.7 High
- nicolargo glancesGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS7.7 High
- vexaVexa's unauthenticated internal transcript endpoint exposed by default7.5 High
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...8.8 High
- canonical canonical-livepatch, livepatch client +1 moreExposed Session Token in canonical-livepatch client snap5.7 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for...6.9 Medium
- silex technology, inc. amc manager, sd-330ac, silextechnology sd-330ac firmware +2 moreSD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for...6.9 Medium
- serge-chat sergeserge-chat serge Model API Endpoint model.py delete_model missing authentication6.9 Medium
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution9.2 Critical
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution9.2 Critical
- transformeroptimus superagiTransformerOptimus SuperAGI Vector Database Management Endpoint vector_dbs.py get_vector_db_details missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog Clean Endpoint views.py missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog logtracks Endpoint views.py missing authentication6.9 Medium
- openclawOpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route9.2 Critical
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authentication for Critical Function9.8 Critical
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authentication for Critical Function7.5 High
@paperclipai/servernpmPaperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode8.3 High- flowiseai flowiseFlowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow7.7 High
- flowiseFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint8.7 High
- simopro technology winmatrixSimopro Technology｜WinMatrix - Missing Authentication9.3 Critical
- goshsgoshs: Empty-username SFTP password authentication bypass in goshs9.8 Critical
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services8.6 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action7.2 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreRemote Desktop Licensing Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreRemote Desktop Licensing Service Elevation of Privilege Vulnerability7.8 High
- fortinet fortios, siemens ruggedcom ape1808 +1 moreA missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7...6.2 Medium
- minioMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads8.8 High
- google cloud agent development kit (adk)Remote Code Execution in Google Agent Development Kit (ADK)9.3 Critical
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication6.9 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication6.9 Medium
- temporal technologies, inc. temporalMissing Authentication on Streaming gRPC Replication Endpoint6.3 Medium
- Show moreLoading…