Cwe-306 - Missing Authentication For Critical Function - Cwe

Related Threat Clusters

• Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems

  Cisco has disclosed a critical authentication bypass vulnerability, CVE-2026-20182, affecting its Catalyst SD-WAN Controller and Manager. This flaw allows unauthenticated remote attackers to bypass authentication and…

  131 articles · Updated May 14, 2026
• Critical Vulnerabilities in Yarbo Robot Firmware Expose Devices to Remote Attacks

  AHA! disclosed three critical vulnerabilities in Yarbo robot firmware v2.3.9, identified as CVE-2026-7413, CVE-2026-7414, and CVE-2026-7415. The vulnerabilities include a hidden backdoor, hardcoded credentials, and an…

  3 articles · Updated May 7, 2026
• ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability

  A critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft has been exploited by the ShinyHunters group, leading to breaches of over 100 organizations, primarily in the education sector. The vulnerability…

  65 articles · Updated June 11, 2026
• Critical Vulnerabilities in pgAdmin 4 Expose Databases to Remote Code Execution

  pgAdmin 4 version 9.16 was released to patch seven vulnerabilities, including critical issues tracked as CVE-2026-12044 to CVE-2026-12050. These vulnerabilities could allow attackers to execute arbitrary commands, gain…

  9 articles · Updated June 22, 2026
• Critical Vulnerabilities Disclosed in Palo Alto Networks PAN-OS Software

  On November 18, 2024, Palo Alto Networks disclosed two critical vulnerabilities in PAN-OS: CVE-2024-0012 and CVE-2024-9474. CVE-2024-0012 is an authentication bypass vulnerability that allows unauthenticated attackers…

  114 articles · Updated April 24, 2026
• Critical Vulnerability in Aqara IAM/SSO Gateway Exposes Signing Key

  The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a critical vulnerability (CVE-2026-50086) that allows unauthorized access to cryptographic operations involving the platform's signing key. This flaw enables…

  2 articles · Updated June 13, 2026
• Oracle CSPU May 2026: 35 Critical Vulnerabilities Addressed

  Oracle released its first Critical Security Patch Update (CSPU) on May 28, 2026, addressing 35 vulnerabilities across multiple product families, including Oracle Database, Oracle REST Data Services, and Oracle…

  68 articles · Updated May 29, 2026
• JetBrains Patches Critical Authentication Bypass and Account Takeover Vulnerabilities

  JetBrains has issued patches for critical vulnerabilities in JetBrains Hub that could lead to full authentication bypass, account takeover, and privilege escalation. The vulnerabilities, tracked as CVE-2026-56141,…

  11 articles · Updated July 2, 2026
• Critical Vulnerabilities Discovered in Apache OFBiz Affecting All Versions Pre-24.09.06

  Apache OFBiz has critical vulnerabilities that allow attackers to exploit hardcoded keys and bypass authentication. The vulnerabilities, CVE-2026-31986 and CVE-2026-45434, were published on 2026-05-19 and affect all…

  3 articles · Updated May 21, 2026
• Seagull Software BarTender Vulnerabilities Enable RCE and Privilege Escalation

  Seagull Software's BarTender has two critical vulnerabilities affecting versions 2010, 2016, 2019, and 2021. CVE-2026-25550 allows unauthenticated remote code execution via the .NET Remoting service on TCP port 7375,…

  3 articles · Updated June 4, 2026

Recent Intelligence Reports

• CVE 2026 0283 — security.paloaltonetworks.com · July 10, 2026
• JVN#40604023 prior disclosure — jvn.jp · July 5, 2026
• JetBrains Patches Critical Hub Authentication Bypass and Account Takeover Vulnerabilities — Gbhackers · July 2, 2026
• Active Exploitation Alert: Critical Oracle E-Business Suite CVE-2026 — Rescana · June 30, 2026
• CVE 2026 12046 — nvd.nist.gov · June 23, 2026
• Claude Fable 5, take two: same model, different harness, and a very different result — Endorlabs · June 18, 2026
• CVE-2026-50086 AKAOMA CVE VULNERABILITIES / 11h The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High). — cve.akaoma.com · June 13, 2026
• Oracle PeopleSoft PeopleTools Zero-Day (CVE-2026-35273) Actively Exploited — Rescana · June 11, 2026

Related Entities