CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreWindows BitLocker Security Feature Bypass Vulnerability6.8 Medium
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability9.6 Critical
- netgear lbr1020, lbr1020 firmware, lbr20 +44 more +46 moreInsufficient authentication and input validation in certain NETGEAR products5.6 Medium
- wp travel kit travelscapeWordPress Seotheme Remote Code Execution Unauthenticated9.3 Critical
- webandprint augmented realityWordPress Augmented-Reality Plugin Remote Code Execution Unauthenticated8.7 High
- rclone, red hat cryostat 4, openshift api for data protection +1 more +3 moreRclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix9.8 Critical
- altium 365, enterprise server +1 morePath Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution10.0 Critical
- altium enterprise server, on-prem enterprise server +1 morePath Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read10.0 Critical
- riello netman 204NetMan 204 Missing Authentication for Administrative Functions9.3 Critical
- dts electronics industry and trade ltd. co. redline wr3200Authentication Bypass in DTS Electronics' Redline WR32009.8 Critical
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an...5.9 Medium
- arista networks eosOn affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).7.2 High
- arista networks eosOn affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).7.2 High
- cliNhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets5.4 Medium
- seagull software, llc. bartender 2010, bartender 2016, bartender 2019 +2 moreSeagull Software BarTender Unauthenticated RCE via .NET Remoting Service9.3 Critical
- framework-y hybrid composerWordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change9.3 Critical
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreAccount Creation Exhaustion8.8 High
- No product listedMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions...8.1 High
- nextlevelbuilder goclawnextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication6.9 Medium
- netiq corporation sentinelSpacelabs Healthcare Sentinel 10.5.x < 11.6.0 Unauthenticated RCE via .NET Remoting9.2 Critical
- qualcomm ar8031 firmware, ar8035 firmware, cologne firmware +215 more +217 moreMissing Authentication for Critical Function in HLOS7.1 High
- qualcomm ar9380 firmware, csr8811 firmware, fastconnect 6200 firmware +244 more +246 moreMissing Authentication for Critical Function in Boot8.2 High
- bottelet daybydaycrmBottelet DaybydayCRM Setting missing authentication5.3 Medium
- enderfga claw-orchestratorEnderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication6.9 Medium
- agenticmailMissing Authentication for Critical Function in @agenticmail/mcp8.7 High
- orca energy heat pump, user portal +1 moreMissing authentication and clear‑text data transmission affecting Orca heat pumps6.3 Medium
- code-projects smart parking systemcode-projects Smart Parking System Admin Endpoint missing authentication6.9 Medium
- deltasql delta sql, deltasql project deltasql +1 moreDelta Sql 1.8.2 Arbitrary File Upload via docs_upload.php9.3 Critical
- mervinpraison praisonaiPraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution9.8 Critical
- mervinpraison praisonaiPraisonAI `deploy --type api` emits a Flask server with authentication disabled by default9.8 Critical
- mervinpraison praisonaiPraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset9.8 Critical
- sensiolabs symfony, symfony twilio-notifier +1 moreSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection6.9 Medium
- sparkle project sparkleSparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection4.2 Medium
- ni systemlink enterpriseAuthentication Bypass Vulnerability in NI SystemLink Enterprise9.3 Critical
- fourth frontier frontier x2, frontier x android application, frontier x ios application +2 moreFourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function8.8 High
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: unauthenticated Debug Service8.7 High
- flippercode wp maps proWP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action9.8 Critical
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions...10.0 Critical
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service...8.8 High
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle universal work queueVulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component:...9.9 Critical
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...9.8 Critical
- rustfsRustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console6.0 Medium
- rustfsRustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers8.8 High
- rustfsRustFS: Unauthenticated RustFS console license endpoint exposes license metadata6.9 Medium
- sensiolabs symfony, /mailtrap-mailer mailtrap-mailer +1 moreSymfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection6.9 Medium
- sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 moreSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection6.9 Medium
- tp-link archer c64 firmware, tp-link systems inc. archer c64 v1.0 +1 moreImproper Authentication Rate Limiting on TP-Link's Archer C648.7 High
- marcantondahmen automadAutomad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint7.5 High
- gladinet triofoxGladinet Triofox Missing Authentication for Critical Functions9.8 Critical
- Show moreLoading…