CWE-269 · weakness in Access Control
Improper Privilege Management
3,429 CVEs · 20 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 20
- check available
- 23
- likely to be exploited
- 36
Every one of the 3,429 is a mark on the map. Named now: 1 to 26, most at risk first.
- Intel Active Management - Authentication Bypass
- SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation
- The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, whi…
- An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as roo…
- An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation o…
- An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is…
- Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
- The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, do…
- An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Pr…
- MinIO is vulnerable to privilege escalation on Linux/MacOS
- VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escala…
- Windows Installer Elevation of Privilege Vulnerability
- smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator…
- Windows Remote Desktop Services Elevation of Privilege Vulnerability
- Windows Error Reporting Service Elevation of Privilege Vulnerability
- Privilege escalation to NetworkService Account access
- Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
- In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no…
- Partner.Microsoft.Com Elevation of Privilege Vulnerability
- McAfee Total Protection (MTP) privilege escalation vulnerability
- Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
- Open Web Analytics 1.7.3 - Remote Code Execution
- MasterStudy LMS <2.7.6 - Improper Access Control
- Apache Airflow - Unauthenticated Variable Import
- rConfig 3.9 - Authentication Bypass(Admin Login)
- Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.