CWE-306: Missing authentication for a critical function
3,816 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 54 of them as exploited in the wild.
- Published CVEs
- 3,816
- Last 12 months
- 2,057
- Critical
- 1,397
- Known exploited
- 54
Critical 1,397High 1,472Medium 893Low 53Not scored 1
CVEs per yearBy the year they were published
- 20152
- 20162
- 201738
- 201854
- 2019180
- 2020254
- 2021151
- 2022210
- 2023217
- 2024269
- 2025486
- 20261,944
Known exploitedNewest addition to KEV first
- CVE-2026-67277
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
Mikrotik · RouterOS
ExploitedHigh8.8 - CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
BerriAI · litellm
ExploitedHigh8.8 - CVE-2026-72529
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
TrueConf · TrueConf Server
ExploitedCritical9.3 - CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are…
Oracle Corporation · Oracle Payments
ExploitedCritical9.8 - CVE-2026-56164
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedMedium5.3 - CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
Splunk · Splunk Enterprise
ExploitedCritical9.8 - CVE-2026-35273
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are…
Oracle Corporation · PeopleSoft Enterprise PeopleTools
ExploitedCritical9.8 - CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
WebPros · cPanel
ExploitedCritical9.3 - CVE-2026-39987
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
marimo-team · marimo
ExploitedCritical9.3 - CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
langflow-ai · langflow
ExploitedCritical9.3
Newest CVEs
- CVE-2026-123530
Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
go-vikunja · vikunja
Medium6.0 - CVE-2026-123963
OpenBMB Internet of Agents Agent Registry app.py register missing authentication
OpenBMB · Internet of Agents
Medium6.9 - CVE-2026-17324
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.3 - CVE-2026-86005
Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew
chartbrew · chartbrew
Critical9.3 - CVE-2026-102610
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
evalstate · fast-agent
Medium6.4 - CVE-2026-102344
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
kunchenguid · lavish-axi
High8.1 - CVE-2026-65960
Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods
cilium · tetragon
High8.8 - CVE-2026-124027
ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage
zhimaAi · chatwiki
High8.7 - CVE-2026-123996
Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
Hisense · VIDAA
Medium4.8 - CVE-2026-123995
Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
Hisense · VIDAA
Medium4.8