CWE-306
CVEs classified under CWE-306, newest first.
1114 CVEsRSS
CVE-2026-111100Medium· 5.3Kiloview E3 NDI Encoder Missing Authentication for Critical Function
The ONVIF device service on the E3 responds to certain informational requests without requiring authentication. A remote, unauthenticated party can retrieve detailed device identifiers along with a list of configured user accounts and th…
CVE-2026-110825High· 7.5Kiloview E3 NDI Encoder Missing Authentication for Critical Function
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this s…
CVE-2026-83938Critical· 10.0Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-13599High· 7.8ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB
Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0.
CVE-2026-114636High· 8.7Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control a…
CVE-2026-114439High· 7.3PoCoretnom23 php-travel-agency-system Session session.php missing authentication
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id c…
CVE-2026-103090High· 8.8PoCUnauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Goo…
CVE-2026-82987High· 7.5CVE-2026-82987
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated …
CVE-2026-111811Critical· 9.0Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15,…
CVE-2026-105944Critical· 10.0Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar ad…
CVE-2026-114261High· 7.3PoCMomoTommy file-management-system Files API FileController.php destroy missing authentication
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files…
CVE-2026-114123High· 7.5D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.js…
CVE-2026-114126High· 8.7Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token t…
CVE-2026-76524High· 7.8Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is…
CVE-2026-114260Medium· 6.5PoCoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipula…
CVE-2026-114248Medium· 5.3PoCdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication
A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan…
CVE-2024-5563Medium· 4.8Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism. Brute force attacks, …
CVE-2026-78334Critical· 9.1Apache bRPC: Missing Authentication for Streaming RPC Frames
Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Auth…
CVE-2026-59562Critical· 9.8Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
CVE-2026-114086Medium· 5.3PoCTrigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams…
CVE-2026-114085High· 7.9Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network ac…
CVE-2026-114092Medium· 6.5PoCTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows…
CVE-2026-114090High· 7.1Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web p…
CVE-2026-114108Critical· 9.8PoCHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can…
CVE-2026-101720Medium· 5.3mysql: mysql: unauthorized data modification via connection handling (CVE-2026-101720)
A flaw was found in MySQL connection handling. An unauthenticated remote attacker with network access can exploit this vulnerability to compromise the database server. Successful exploitation allows an attacker to perform unauthorized data…
CVE-2026-101781High· 8.8mysql: mysql: Server takeover via Group Replication GCS (CVE-2026-101781)
A flaw was found in MySQL's Group Replication Group Communication System (GCS). An unauthenticated attacker located on the same adjacent network segment can exploit this vulnerability without requiring privileges or user interaction. Succe…
CVE-2026-97406Critical· 9.1Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials.
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication a…
CVE-2026-112949Medium· 4.7PoCVitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can r…
CVE-2026-113358High· 7.5PoCLavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbi…