CWE-306: Missing Authentication for Critical Function — known CVE vulnerabilities

CVEs classified under CWE-306 (Missing Authentication for Critical Function), ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2026-20357 — CVSS 10.0 (critical): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a…
• CVE-2026-58115 — CVSS 10.0 (critical): A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with…
• CVE-2026-63508 — CVSS 10.0 (critical): Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over…
• CVE-2026-56163 — CVSS 10.0 (critical): Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges…
• CVE-2026-64812 — CVSS 10.0 (critical): In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
• CVE-2026-60644 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions…
• CVE-2026-60389 — CVSS 10.0 (critical): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that…
• CVE-2026-60379 — CVSS 10.0 (critical): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that…
• CVE-2026-60365 — CVSS 10.0 (critical): Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for…
• CVE-2026-60360 — CVSS 10.0 (critical): Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are…
• CVE-2026-60217 — CVSS 10.0 (critical): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are…
• CVE-2026-47056 — CVSS 10.0 (critical): Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are…
• CVE-2026-10577: A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does…
• CVE-2026-62422 — CVSS 10.0 (critical): In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass…
• CVE-2026-54309 — CVSS 10.0 (critical): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the…
• CVE-2026-50242 — CVSS 10.0 (critical): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via…
• CVE-2026-49257 — CVSS 10.0 (critical): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot…
• CVE-2026-46846 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that…
• CVE-2026-46803 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that…
• CVE-2026-46800 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are…
• CVE-2026-46798 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are…
• CVE-2026-46781 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions…
• CVE-2026-46778 — CVSS 10.0 (critical): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions…
• CVE-2026-35301 — CVSS 10.0 (critical): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are…
• CVE-2026-35292 — CVSS 10.0 (critical): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are…
• CVE-2026-44329 — CVSS 10.0 (critical): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group…
• CVE-2026-44327 — CVSS 10.0 (critical): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without…
• CVE-2026-9152: A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations…
• CVE-2026-20223 — CVSS 10.0 (critical): A vulnerability in the&nbsp;access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote…
• CVE-2026-34162 — CVSS 10.0 (critical): FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runToo…
• CVE-2026-3611 — CVSS 10.0 (critical): The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default…
• CVE-2026-23693 — CVSS 10.0 (critical): ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to…
• CVE-2026-2577 — CVSS 10.0 (critical): The WhatsApp bridge component in Nanobot binds the WebSocket server to all network interfaces (0.0.0.0) on port 3001 by default and does…
• CVE-2026-1633 — CVSS 10.0 (critical): The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing…
• CVE-2025-69425: The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with…
• CVE-2025-58083 — CVSS 10.0 (critical): General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to…
• CVE-2025-55108 — CVSS 10.0 (critical): The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions…
• CVE-2025-61956 — CVSS 10.0 (critical): Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests…
• CVE-2025-61945 — CVSS 10.0 (critical): Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once…
• CVE-2025-52665 — CVSS 10.0 (critical): A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi…
• CVE-2025-9574 — CVSS 10.0 (critical): Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware…
• CVE-2025-41656 — CVSS 10.0 (critical): An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for…
• CVE-2025-34039: A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet…
• CVE-2025-32440 — CVSS 10.0 (critical): NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication…
• CVE-2025-36535 — CVSS 10.0 (critical): The embedded web server lacks authentication and access controls, allowing unrestricted remote access. This could lead to configuration…
• CVE-2024-46506 — CVSS 10.0 (critical): NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings…
• CVE-2025-32433 — CVSS 10.0 (critical) — actively exploited: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH…
• CVE-2025-24865 — CVSS 10.0 (critical): The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker…
• CVE-2024-39608 — CVSS 10.0 (critical): A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP…
• CVE-2024-56799 — CVSS 10.0 (critical): Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the…