CWE-306

Memu Play 6.0.7 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileg

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message s

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's Manual

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authoriz

Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket e

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted,

CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-4

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Setup and Administ

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC end

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting i

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecate

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be per

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established wi

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthe

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoi

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface th

Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attack

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configura

The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read

FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to uplo

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary

WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allow

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitr

WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the aut

Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes r

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to bef

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all ver

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload maliciou

Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated at

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .N

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electron

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauth

WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbit

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentic

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supp