CWE-306

2,205 vulnerabilities with CWE-306

CVE-2026-33032 CRITICAL

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

CVSS 9.8

CVE-2026-34472 HIGH

ZTE ZXHN H188A V6.0.10P2_TE/V6.0.10P3N3_TE - Info Disclosure

CVSS 7.1

CVE-2026-5000 HIGH

PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication

CVSS 7.3

CVE-2026-34411 MEDIUM

Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs

CVSS 5.3

CVE-2026-4959 HIGH

OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication

CVSS 7.3

CVE-2026-33366 MEDIUM

BUFFALO Wi-Fi router - Auth Bypass

CVSS 5.3

CVE-2026-3527 MEDIUM

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

CVSS 6.5

CVE-2026-24068 HIGH

Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic Library

CVSS 8.8

CVE-2026-1724 MEDIUM

Missing Authentication for Critical Function in GitLab

CVSS 6.8

CVE-2026-32326 MEDIUM

Sharp home 5G HR01 <=38JP_0_490 - Auth Bypass

CVSS 5.7

CVE-2026-2417 CRITICAL

Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller

CVE-2026-33159 MEDIUM

Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users

CVSS 6.5

CVE-2026-33340 CRITICAL

LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint

CVSS 9.1

CVE-2026-4649 MEDIUM

Auth bypass in Apache Artemis allows reading all internal messages

CVE-2026-4640 HIGH

Galaxy Software Services｜Vitals ESP - Missing Authentication

CVSS 7.5

CVE-2026-33719 HIGH

WWBN AVideo <=26.0 - Auth Bypass

CVSS 8.6

CVE-2026-31846 MEDIUM

Nexxt Solutions Nebula 300+ <=12.01.01.37 - Info Disclosure

CVSS 6.5

CVE-2026-4582 MEDIUM

Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication

CVSS 5.0

CVE-2026-4562 HIGH

MacCMS Timming API Endpoint Timming.php weak authentication

CVSS 7.3

CVE-2026-2756 MEDIUM

OmniPEMF NeoRhythm BLE missing authentication

CVSS 5.0

CVE-2026-32896 MEDIUM

OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin

CVSS 4.8

CVE-2026-32064 HIGH

OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer

CVSS 7.7

CVE-2026-33231 HIGH

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

CVSS 7.5

CVE-2026-33203 HIGH

SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass

CVSS 7.5

CVE-2026-29796 CRITICAL

IGL-Technologies eParking.fi Missing Authentication for Critical Function

CVSS 9.4