CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication5.3 Medium
- coollabsio coolifycoollabsio Coolify GitHub App Setup redirect missing authentication6.9 Medium
- getgrav grav-plugin-commentsgrav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure8.7 High
- issdandavis scbe-aethermooreSCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests7.5 High
- ciena navigator ncsUnauthenticated Event Stream Exposure of Session Tokens in Navigator NCS7.5 High
- yzcheng90 x-springbootX-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint6.9 Medium
- zammadZammad: Denial of Service via OTRS Import Controller8.7 High
- zhistaredu startrainingzhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication6.9 Medium
- zhistaredu startrainingzhistaredu StarTraining Druid Console index.html anonymous missing authentication6.9 Medium
- gibbonedu gibbonGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication6.9 Medium
- botslab g980hBotslab G980H Dashcams Missing Authentication for Critical Function6.9 Medium
- botslab g980hBotslab G980H Dashcams Missing Authentication for Critical Function7.0 High
- dell thinos 10Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing...8.6 High
- honeywell pd45 industrial printerUnauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.0100409.8 Critical
- bytebase dbhubDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution9.3 Critical
- volotat anagnorisisvolotat Anagnorisis Socket.IO Connect app.py missing authentication6.9 Medium
- klever-io klever-goKlever-Go: /log controls global node logging8.6 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.2 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.3 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a...7.4 High
- zohocorp manageengine applications managerBroken Access Control vulnerability7.6 High
- zohocorp manageengine opmanagerAuthentication Bypass vulnerability8.8 High
- pollen robotics reachy miniReachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint8.8 High
- acer nitrosense v5MQTT WebSocket Command Execution Vulnerability in NitroSense6.1 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.1 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport8.6 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials9.1 Critical
- gitroomhq postiz-appUnauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key7.1 High
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause...8.3 High
- zohocorp manageengine adselfservice plusAuthentication bypass vulnerability8.6 High
- gigatech pdv5701Gigatech PDV5701 WebSocket Service index.html missing authentication10.0 Critical
- mrpear desktopsmsDesktopSMS 1.11.0 Unauthorized Access via Local Service7.4 High
- omega solution hrm osOmega Solution HRM OS Role Permission API permission missing authentication6.9 Medium
- No product listedThe graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command,...7.1 High
- watchdog anti-virusWatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL6.9 Medium
- nginxproxymanager nginx-proxy-managerNginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication6.9 Medium
- pixelfedPixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication5.3 Medium
- 1panel-dev cordyscrmCordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`5.0 Medium
- 1panel-dev cordyscrmCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`9.3 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.9 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.9 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.8 Critical
- modeltc lightllmLightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint9.3 Critical
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities5.3 Medium
- forget-c jellyfish ai short drama studioForget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication6.9 Medium
- f1bonacc1 process-composeProcess Compose: Browser DNS rebinding lets websites control local process-compose MCP tools5.1 Medium
- stacklok toolhive, toolhive-studio +1 moreToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement8.8 High
- carecam hmt.cm2507 firmwareCareCam CM2507 Missing Authentication for Critical Function2.4 Low
- carecam hmt.cm2507 firmwareCareCam CM2507 Missing Authentication for Critical Function2.3 Low
- carecam hmt.cm2507 firmwareCareCam CM2507 Missing Authentication for Critical Function8.7 High
- Show moreLoading…