CWE-306
CVEs classified under CWE-306, newest first.
1116 CVEsRSS
CVE-2026-109439Critical· 9.8Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to…
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to…
CVE-2026-110632High· 8.1PoCReport One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater t…
CVE-2026-110619Medium· 4.8PoCfrp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attacker…
CVE-2026-110618High· 8.1SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read…
CVE-2026-110616High· 8.1PoCNullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending re…
CVE-2026-16740Critical· 9.8Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from…
CVE-2026-103905High· 7.5The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can the…
CVE-2026-109969Medium· 4.7A flaw was found in the clevis PKCS#11 pin
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user …
CVE-2026-108473High· 8.7Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication o…
CVE-2026-55786High· 8.4PoCFlyto2 Core is an execution kernel for automation and AI-agent workflows
Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module reg…
CVE-2026-97793High· 7.0Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVE-2026-96858Medium· 5.5Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
CVE-2026-96313High· 7.0Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2026-96183Medium· 5.5Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose information locally.
CVE-2026-85884High· 7.8PoCMissing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83928High· 8.8Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVE-2026-83854Medium· 5.5Improper access control in Windows Notification allows an authorized attacker to disclose information locally.
Improper access control in Windows Notification allows an authorized attacker to disclose information locally.
CVE-2026-83715High· 7.1Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
Missing authentication for critical function in Windows Error Reporting allows an authorized attacker to perform tampering locally.
CVE-2026-83656Medium· 4.7Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
CVE-2026-83654High· 7.8Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Missing authentication for critical function in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
CVE-2026-70580High· 8.8Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.
Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally.
CVE-2026-70137Medium· 5.5Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.
CVE-2026-62879Medium· 5.5Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.
Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.
CVE-2026-107607Medium· 6.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.
CVE-2026-107606Medium· 6.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.
CVE-2026-107605Medium· 6.2SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.
SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.
CVE-2026-105728High· 7.5Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
CVE-2026-69227Critical· 9.8A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
CVE-2026-55183Critical· 9.6PoCRClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, an…
CVE-2026-110128High· 7.5fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderI…