CWE-306

The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /t

Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed

A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 thro

A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file bl

A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/dele

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes

Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Manag

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Mana

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functi

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attack

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memo

The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functio

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memo

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same devi

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any networ

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the att

Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Fake th

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauth

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authenticat

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_serv

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/posta

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata P

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Inter

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supp

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's bef

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace membe

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the d

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/appli

A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via t

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The suppo

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonl

A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing una

A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. Impacted is an unknown function of the compone

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlas

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critic

A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetoo

A security flaw has been discovered in Flycatcher Toys smART Pixelator 2.0. Affected by this issue is some unknown funct

Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown fun

A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of t

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the