By weakness (CWE)

CWE-306: related vulnerabilities

CVEs classified under CWE-306. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

113 published vulnerabilities · page 2 of 2

• CVE-2026-54068MEDIUM 5.9

  SiYuan, an open-source personal knowledge management system, contains an authentication bypass vulnerability in its icon retrieval API endpoint. The /api/icon/getDynamicIcon endpoint is intentionally excluded from authentication checks but executes server-side Go templates that can query the underlying SQLite database. An attacker without login credentials can exploit this by sending a specially crafted request with a known block ID to extract all of a user's notes, tags, file references, and metadata. The vulnerability affects all versions before 3.7.0 and is resolved in that release.

• CVE-2026-45610MEDIUM 5.7

  WWBN AVideo, an open-source video hosting platform, contains a cross-site request forgery (CSRF) flaw that allows an attacker to disable two-factor authentication (2FA) on a victim's account without their knowledge. If a logged-in AVideo user visits a malicious website controlled by an attacker, that site can silently turn off the victim's 2FA protection in a single HTTP request. This happens because the vulnerable endpoint doesn't validate the origin of the request or require re-authentication. Once 2FA is disabled, the account becomes significantly easier to compromise if credentials are later leaked or guessed.

• CVE-2026-41047MEDIUM 5.5

  qSnapper, a snapshot management tool from Presire, contains a missing authentication control in its snapshot diff feature. This allows a local user to view sensitive information that should be restricted, even if they lack normal read permissions. The vulnerability affects versions prior to 1.3.3 and requires local system access to exploit.

• CVE-2026-11848MEDIUM 5.3

  CVE-2026-11848 is a missing authentication vulnerability in IEI Integration Corp's iRM-IEI Remote Management platform. An attacker on the network can access certain system configuration information without needing valid credentials. While the exposed data is limited to partial configuration details rather than sensitive secrets, the ability to query system state without authentication creates an information disclosure pathway that could support reconnaissance for further attacks.

• CVE-2026-31983MEDIUM 5.3

  CVE-2026-31983 is a missing authentication vulnerability in the SSH keys synchronization endpoint of Nozomi Networks products. An attacker without credentials can query this endpoint to retrieve sensitive information: a complete list of users who have uploaded SSH keys, their group memberships, and the actual public SSH keys themselves. This is a straightforward authentication bypass that exposes information an attacker would typically need valid credentials to access.

• CVE-2026-54036MEDIUM 5.3

  LibreChat versions prior to 0.8.4-rc1 contain a critical flaw in two-factor authentication (2FA) management. An attacker who has compromised a user's session token can call a specific API endpoint to completely reset that user's 2FA settings—overwriting their TOTP secret, invalidating backup codes, and disabling 2FA entirely—without needing to know or verify the existing 2FA credentials. This locks legitimate users out of their own account security while giving the attacker an open door to permanent access.

• CVE-2026-55605MEDIUM 5.3

  DeepSeek MCP Server, a tool for integrating DeepSeek V4 AI capabilities, had a critical flaw in its self-hosted HTTP configuration: the main API endpoint accepted requests without any authentication. This meant anyone with network access to a running instance could interact with it as if they were an authorized user. They could initialize sessions, list available tools, and invoke local functions—including one that exposes session data and another that uses the server's own API credentials to make DeepSeek API calls. The issue affected versions 1.4.2 through 1.7.x, and self-hosted deployments using the default container configuration were particularly exposed since HTTP mode and port 3000 are enabled by default.

• CVE-2026-56299MEDIUM 5.3

  Capgo, a software build and deployment tool, has a security flaw that lets attackers bypass authentication on a specific upload endpoint. By sending specially crafted HTTP OPTIONS requests, an attacker can trigger errors repeatedly without needing valid credentials. This causes the service to become unavailable—a denial-of-service attack. The vulnerability affects versions before 12.128.2.

• CVE-2026-56321MEDIUM 5.3

  Capgo's backend authentication system has an inconsistency: the GET endpoint for retrieving role bindings in a specific organization doesn't require authentication before reaching the application code, while the POST and DELETE endpoints do. The endpoint itself still rejects unauthenticated requests with an 'Unauthorized' response, so the vulnerability doesn't directly leak data today. However, this architectural mismatch creates a maintenance risk—if the application-level authorization check is removed or modified in future updates, the missing middleware layer would fail to catch it, potentially exposing sensitive organizational role information.

• CVE-2026-61344MEDIUM 5.3

  California's Superior Court Hearing Reminder Service (HRS) at https://www.hrs.courts.ca.gov contains an API endpoint that leaks court hearing reminder records to anyone on the internet without requiring login credentials. The exposed data is not encrypted or restricted, meaning an attacker can retrieve potentially sensitive case and scheduling information simply by querying the endpoint. This is a missing authentication issue affecting a public government service.

• CVE-2026-8694MEDIUM 5.3

  Devolutions PowerShell Universal versions up to 2026.1.7 contain an access control flaw that allows anyone on the network to read the OpenAPI specification files for REST endpoints you've created. These specification files can reveal sensitive details about your API structure, parameters, and authentication methods—information that normally should only be available to authenticated users. An attacker doesn't need valid credentials to exploit this; they simply request the specification and receive it.

• CVE-2026-54776MEDIUM 4.4

  CoreWCF is a .NET Core implementation of Windows Communication Foundation that allows applications to build service-oriented systems. A security weakness exists in how CoreWCF handles client authentication when services use Unix Domain Sockets with PosixIdentity credentials. Specifically, the vulnerability allows an attacker with local system access to bypass the authentication process by connecting without completing the required security handshake, potentially gaining unauthorized access to service functionality. This affects CoreWCF versions before 1.8.1 and 1.9.1.

• CVE-2026-59715LOW 3.1

  Open WebUI versions 0.6.16 through 0.9.x contain a flaw in how their real-time collaboration features handle user authentication. The Socket.IO server—which powers live document editing—was misconfigured to accept certain collaboration events (specifically document awareness updates and leave notifications) from any connection, even those without a valid user login. This allows an unauthenticated attacker to interfere with the state of shared documents, though the impact is limited to integrity (not confidentiality or availability). The vulnerability was resolved in version 0.10.0.