CWE-272 · weakness in Access Control
Least Privilege Violation
43 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 43 is a mark on the map. Named now: 1 to 26, most at risk first.
- TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation
- D-link DIR-823G Web boa.conf least privilege violation
- Web Server Running with Root Privileges in dormakaba access manager
- OpenObserve Privilege Escalation Vulnerability in Users API
- TOTOLINK EX200 Web boa.conf least privilege violation
- Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path
- Privilege Escalation in mintplex-labs/anything-llm
- OpenObserve Improper Authorization Allows Admin User to Remove Root User
- D-Link DIR-823G vsftpd vsftpd.conf least privilege violation
- OpenObserve Unauthorized Access Vulnerability in Users API
- Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation
- D-Link DCS-5615 Boa Webserver boa.conf least privilege violation
- D-Link DGS-1100-08PD Web boa.conf least privilege violation
- TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
- Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers
- Gitea API team demotion not applied to unit permissions
- iControl REST and tmsh vulnerability
- HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
- Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator
- Pepr Overly Permissive RBAC ClusterRole in Admin Mode
- Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks.
- Local Privilege Escalation
- TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
- In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
- TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation
- TRENDnet TEW-822DRE vsftpd least privilege violation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.