CWE-306

2,344 vulnerabilities with CWE-306

CVE-2025-68715 CRITICAL

Panda Wireless PWRU0 <2.2.9 - Privilege Escalation

CVSS 9.1

CVE-2025-65731 MEDIUM

D-Link Router DIR-605L - Command Injection

CVSS 6.8

CVE-2025-15346 CRITICAL

wolfssl-py <= 5.8.2 - Improper Authentication via Missing WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT Flag

CVE-2025-31963 LOW

HCL BigFix IVR 4.2 - Unauthenticated Configuration Change via Local Setup Interface

CVSS 2.9

CVE-2025-14346 CRITICAL

WHILL Model C2 Electric Wheelchair and Model F Power Chair - Unauthenticated Bluetooth Command Injection

CVSS 9.8

CVE-2025-15026 CRITICAL

Centreon Awie 24.04.0-24.04.2 - Unauthenticated Access to ACL-Protected Functionality

CVSS 9.8

CVE-2025-3646 HIGH

Petlibro < 1.7.31 - Unauthenticated Authorization Bypass via Device Share API

CVSS 7.3

CVE-2025-66377 HIGH

Pexip Infinity <39.0 - Privilege Escalation

CVSS 7.5

CVE-2025-3232 HIGH

Mitsubishi Electric Europe smartRTU < 3.37 - Unauthenticated Remote Code Execution via API Route

CVSS 7.5

CVE-2025-66445 HIGH

Hitachi Infrastructure Analytics Advisor <11.0.5.00 - Auth Bypass

CVSS 7.1

CVE-2025-65856 CRITICAL

Xiongmai XM530 IP Cameras V5.00.R02.000807D8.10010.346624.S.ONVIF - Unauthenticated Sensitive Information Exposure

CVSS 9.8

CVE-2025-12049 CRITICAL

Sharp Display Solutions Media Player MP-01 - Unauthenticated Critical Function Access

CVSS 9.8

CVE-2025-14300 HIGH

Tapo C200 V3 < V3_1.4.5 Build 251104 - Unauthenticated Denial of Service via connectAP Interface

CVSS 8.1

CVE-2025-52692 HIGH

Linksys E9450-SG Firmware - Unauthenticated Access to Administration Functions via Crafted URL

CVSS 8.8

CVE-2025-63391 HIGH

Open-WebUI <= 0.6.32 - Unauthenticated Sensitive Data Exposure via /api/config Endpoint

CVSS 7.5

CVE-2025-63390 MEDIUM

AnythingLLM 1.8.5 - Unauthenticated Workspace Information Disclosure via /api/workspaces Endpoint

CVSS 5.3

CVE-2025-63389 CRITICAL

ollama < 0.12.3 - Unauthenticated API Endpoint Access

CVSS 9.8

CVE-2025-65010 HIGH

WODESYS WD-R608U WDR28 WDR122B V2.0 - Unauthenticated Admin Password Change via Initial Configuration Wizard

CVE-2025-65007 HIGH

WODESYS WD- R608U - Command Injection

CVE-2025-43428 CRITICAL

iPadOS < 26.2 - Unauthenticated Hidden Photos Album Access

CVSS 9.8

CVE-2025-34434 CRITICAL

AVideo < 20.1 - Unauthenticated Arbitrary File Upload and Deletion via ImageGallery Plugin

CVSS 9.1

CVE-2025-14038 HIGH

EDB Hybrid Manager < 1.3.3 and < 2025.12.0 - Unauthenticated Missing Authorization via gRPC Endpoints

CVSS 7.0

CVE-2025-14567 MEDIUM

haxxorsid stock-management-system < 2018-01-27 - Unauthenticated Missing Authentication in /api/employees

CVSS 5.3

CVE-2025-12348 MEDIUM

Icegram Express <5.9.10 - Auth Bypass

CVSS 5.3

CVE-2025-67780 MEDIUM

SpaceX Starlink Dish - Unauthenticated RCE

CVSS 4.2