CWE-278 · weakness in Access Control
Insecure Preserved Inherited Permissions
7 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.
- Cargo not respecting umask when extracting crate archives
- Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.
- IBM i privilege escalation
- Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2
- Nix sandbox escape
- mise: Incorrect file ownership, when installed by the root user using `install.sh`
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.