Missing Authentication for Critical Function

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any n

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can pe

@agenticmail/mcp Missing Authentication for Critical Function

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as p

The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

F5 BIG-IP Missing Authentication Vulnerability

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability

Langflow Missing Authentication Vulnerability

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability

Microsoft Windows LSA Spoofing Vulnerability

Apache Airflow's Experimental API Authentication Bypass

Marimo Remote Code Execution Vulnerability

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

Fortinet FortiOS Default Configuration Vulnerability

ThinkPHP Remote Code Execution Vulnerability

VMware vCenter Server Information Disclosure Vulnerability

Fortinet FortiManager Missing Authentication Vulnerability

Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability

Oracle E-Business Suite Unspecified Vulnerability

MiCollab, MiVoice Business Express Access Control Vulnerability

TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability

Langflow Code Injection Vulnerability

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

TerraMaster OS Remote Command Execution Vulnerability

Smartbedded Meteobridge Command Injection Vulnerability

Palo Alto Networks Expedition Missing Authentication Vulnerability

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Veeam Backup & Replication Remote Code Execution Vulnerability

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

SonicWall Email Security Improper Privilege Management Vulnerability

NUUO NVRmini2 Devices Missing Authentication Vulnerability

SAP Solution Manager Missing Authentication for Critical Function Vulnerability

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.

An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be exploited by attackers to Unauthorized access to the victim’s device.

The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain partial system configuration information.

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privil

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publicat

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all cus

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives