CWE-1220 · weakness in Access Control
Insufficient Granularity of Access Control
122 CVEs · 3 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 3
Every one of the 122 is a mark on the map. Named now: 1 to 26, most at risk first.
- This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with…
- Microsoft Defender Elevation of Privilege Vulnerability
- Active Directory Federation Services Elevation of Privilege Vulnerability
- IBM Spectrum Fusion HCI improper access control
- Freeipa: idm: privilege escalation from host to domain admin in freeipa
- .NET and Visual Studio Elevation of Privilege Vulnerability
- Data Inference in Now Platform via Conditional ACLs
- All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admi…
- Outlook for Android Elevation of Privilege Vulnerability
- Postgresql: merge fails to enforce update or select row security policies
- cgi.force_redirect configuration is bypassable due to the environment variable collision
- Microsoft SharePoint Server Remote Code Execution Vulnerability
- Non Privilege User can Enable or Disable Registered in openemr/openemr
- Netmaker vulnerable to Insufficient Granularity of Access Control
- Accounting User Can Download Patient Reports in openemr in openemr/openemr
- SQL Server Elevation of Privilege Vulnerability
- Microsoft SQL Server Elevation of Privilege Vulnerability
- Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
- Improper access control vulnerability
- Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into register…
- Insufficient Granularity of Access Control in usememos/memos
- Windows Event Logging Service Remote Code Execution Vulnerability
- API returns timesheet entries a user should not be authorized to view
- Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
- Openshift-logging: lokistack authorisation is cached too broadly
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.