CWE-266 · weakness in Access Control
Incorrect Privilege Assignment
1,273 CVEs · 1 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
- check available
- 8
- likely to be exploited
- 8
Every one of the 1,273 is a mark on the map. Named now: 1 to 26, most at risk first.
- LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of gr…
- WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin
- OttoKit < 1.0.83 - SureTriggers allows Privilege Escalation
- Eventin <= 4.0.26 - Privilege Escalation
- Modular DS - Broken Access Control
- Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation
- Hippoo Mobile App for WooCommerce - Broken Access Control
- WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
- WordPress OttoKit Plugin <= 1.1.40 - Unauthenticated Privilege Escalation via connection-denied Token
- Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability
- D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control
- Teledyne FLIR AX8 User Registration test_login.php improper authorization
- Incorrect privilege assignment
- D-Link DIR-823G DDNS Service HNAP1 SetDDNSSettings improper authorization
- TOTOLINK A3700R Password cstecgi.cgi setWiFiEasyGuestCfg access control
- Tenda FH1202 default.cfg access control
- D-Link DIR-618/DIR-605L Firewall Service formAdvFirewall access control
- Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation
- WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability
- D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control
- A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and esc…
- wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization
- sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by usin…
- D-Link DIR-823G UPnP Service HNAP1 SetUpnpSettings improper authorization
- Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability
- WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.