CWE-306: Missing authentication for a critical function
3,774 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 54 of them as exploited in the wild.
- Published CVEs
- 3,774
- Last 12 months
- 2,025
- Critical
- 1,393
- Known exploited
- 54
Critical 1,393High 1,455Medium 874Low 52Not scored 0
CVEs per yearBy the year they were published
- 202511
- 20254
- 20253
- 20255
- 20261,798
- 2026430
- 2026236
- 2026225
- 2026165
- 2026259
- 202665
- 202644
Known exploitedNewest addition to KEV first
- CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
Mikrotik · RouterOS
ExploitedHigh8.8 - CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
BerriAI · litellm
ExploitedHigh8.8 - CVE-2026-72529
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
TrueConf · TrueConf Server
ExploitedCritical9.3 - CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are…
Oracle Corporation · Oracle Payments
ExploitedCritical9.8 - CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedMedium5.3 - CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
Splunk · Splunk Enterprise
ExploitedCritical9.8 - CVE-2026-35273
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are…
Oracle Corporation · PeopleSoft Enterprise PeopleTools
ExploitedCritical9.8 - CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
WebPros · cPanel
ExploitedCritical9.3 - CVE-2026-39987
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
marimo-team · marimo
ExploitedCritical9.3 - CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
langflow-ai · langflow
ExploitedCritical9.3
Newest CVEs
- CVE-2026-121816
About Time Technologies｜Herowatch Mini - Missing Authentication
About Time Technologies · Herowatch Mini
High8.7 - CVE-2026-92188
Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability
Quest · Foglight for Databases
Critical9.8 - CVE-2022-29966
Emerson Ovation Missing Authentication for Critical Functionality
Emerson · Ovation
Critical9.3 - CVE-2026-121736
NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
nocodb · nocodb
Medium6.9 - CVE-2026-63482
Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
yeti-platform · yeti
High7.5 - CVE-2026-121557
WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
wppconnect · wppconnect-server
High8.2 - CVE-2026-121555
Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
DrizzleTime · Foxel
High8.7 - CVE-2026-121454
Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests
padloc · padloc
Medium6.3 - CVE-2026-119740
Nexbox A95X Amlogic S905X UART Unauthenticated Console Access
Nexbox · A95X
High7.0 - CVE-2026-119731
Munshi Payment Bypass via Unauthenticated Webhook Endpoint
Petpooja · Munshi
High8.7