CWE-306

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonat

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to direct

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS a

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the N

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remot

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The

Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The suppor

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 t

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to di

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to el

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobi

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnera

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Sup

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary co

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verifica

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (develop

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple cr

An issue was discovered in Panda Wireless PWRU0 devices with firmware 2.2.9 that exposes multiple HTTP endpoints (/gofor

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odo

MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication,

C&Cm@il developed by HGiga has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to rea

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Genera

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 1

LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to N

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connect

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the brow

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Mana

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supp

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supp

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints

The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthentica

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly

The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at