Improper Ownership Management

Every one of the 31 is a mark on the map. Named now: 1 to 26, most at risk first.

1. A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a…CVE-2023-0386Linux · CVSS 7.8 · 7.9% likely

   Linux

2. Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership ManagementCVE-2026-23514kiteworks · CVSS 8.8 · 1.1% likely

   Kiteworks

3. SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership managementCVE-2024-8949SourceCodester · CVSS 6.3 · 0.7% likely

   SourceCodester

4. PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)CVE-2024-3383Palo Alto Networks · CVSS 7.4 · 0.6% likely

   Palo Alto Networks

5. Improper Ownership Management in GitLabCVE-2023-0989GitLab · CVSS 4.3 · 0.5% likely

   GitLab

6. ICSA-20-140-02 Emerson OpenEnterpriseCVE-2020-10632Emerson · CVSS 8.8 · 0.5% likely

   Emerson

7. Bypass of safe.directory protections in GitCVE-2022-29187git · CVSS 7.8 · 0.4% likely

   Git

8. meetyoucrop big-whale Admin Module all.api improper ownership managementCVE-2023-7226meetyoucrop · CVSS 6.3 · 0.4% likely
9. PeerTube Arbitrary Playlist Creation via ActivityPub ProtocolCVE-2025-32946Framasoft · CVSS 5.3 · 0.4% likely

   Framasoft

10. A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priviledged operation. A…CVE-2024-39755Veertu · CVSS 7.8 · 0.4% likely
11. A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.CVE-2024-45103Lenovo · CVSS 4.3 · 0.3% likely

    Lenovo

12. It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege…CVE-2017-12189Red Hat, Inc. · 0.3% likely

    Red Hat

13. Users can impersonate import requesters if their actor IDs coincide in ImportDumpCVE-2024-47816miraheze · CVSS 6.4 · 0.3% likely

    Miraheze

14. PeerTube Arbitrary Playlist Creation via REST APICVE-2025-32945Framasoft · CVSS 4.3 · 0.3% likely

    Framasoft

15. IBM OpenPages information disclosureCVE-2024-43176IBM · CVSS 5.4 · 0.3% likely

    IBM

16. Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables CheckoutCVE-2026-86769grokability · CVSS 4.3 · 0.3% likely

    Grokability

17. Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010CVE-2024-13246Drupal · CVSS 5.3 · 0.3% likely

    Drupal

18. Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`CVE-2026-50130pi-hole · CVSS 8.8 · 0.3% likely

    Pi-Hole

19. Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission…CVE-2025-67642Jenkins Project · CVSS 4.3 · 0.2% likely

    Jenkins

20. An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may acces…CVE-2026-3867Moxa · CVSS 6 · 0.2% likely

    Moxa

21. IBM OpenPages with Watson information disclosureCVE-2025-1112IBM · CVSS 4.3 · 0.2% likely

    IBM

22. Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) VulnerabilityCVE-2022-0026Palo Alto Networks · CVSS 6.7 · 0.2% likely

    Palo Alto Networks

23. Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013CVE-2024-13249Drupal · CVSS 5.4 · 0.2% likely

    Drupal

24. IBM InfoSphere Information Server file manipulationCVE-2025-3629IBM · CVSS 4.3 · 0.2% likely

    IBM

25. In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NUL…CVE-2026-40214OpenStack · CVSS 6.3 · 0.2% likely

    Openstack

26. A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.CVE-2024-45104Lenovo · CVSS 6.3 · 0.2% likely

    Lenovo

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.