CWE-306

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary comm

Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configura

MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root passwor

MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to se

Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateU

A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and includ

Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons al

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endp

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authenti

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that

iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized a

Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access t

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting f

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public

An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur.

Flag Forge is a Capture The Flag (CTF) platform. Starting in version 2.0.0 and prior to version 2.3.2, the `/api/admin/b

A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticat

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubN

A malicious actor can access camera configuration information, including account credentials, without authenticating whe

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or e

An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network acce

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5

An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical funct

The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthe

Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /

The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Mis

KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. Th

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below conta

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and dele

A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A speciall

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte

The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeov

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bl

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the func

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenti

An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php

In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protoc

In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remo

The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off conditio

Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an

Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read a