CWE-306 Missing Authentication for Critical Function

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Klever-Go: /log controls global node logging

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools