Skip to content
BackEsc
Sign in

CWE-284 · weakness in Access Control

Improper Access Control

7,486 CVEs · 34 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
34
check available
32
likely to be exploited
88

Every one of the 7,486 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. PaperCut - Unauthenticated Remote Code ExecutionCVE-2023-27350PaperCut · CVSS 9.8 · 100% likely

    PaperCut

  2. Cisco Small Business WAN VPN Routers - Sensitive Information DisclosureCVE-2019-1653Cisco · CVSS 7.5 · 100% likely

    Cisco

  3. Joomla! Webservice - Password DisclosureCVE-2023-23752Joomla! Project · CVSS 5.3 · 100% likely

    Joomla

  4. Adobe ColdFusion - Access Control BypassCVE-2023-38205Adobe · CVSS 7.5 · 100% likely

    Adobe

  5. Adobe ColdFusion - Access Control BypassCVE-2023-29298Adobe · CVSS 7.5 · 100% likely

    Adobe

  6. ProFTPd - Remote Code ExecutionCVE-2015-3306ProFTPD · CVSS 10 · 99% likelycovered by CyberSIXT

    ProFTPD ProjectFlax Typhoon5 articles

  7. Apache HugeGraph-Server - Remote Command ExecutionCVE-2024-27348Apache Software Foundation · CVSS 9.8 · 99% likely

    Apache

  8. Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted ap…CVE-2012-4681Oracle · CVSS 9.8 · 99% likely

    Oracle

  9. Adobe ColdFusion - Arbitrary File ReadCVE-2024-20767Adobe · CVSS 7.4 · 99% likely

    Adobe

  10. Citrix ShareFile StorageZones Controller - Unauthenticated Remote Code ExecutionCVE-2023-24489Citrix · CVSS 9.8 · 97% likely

    Citrix (NetScaler)

  11. Adobe ColdFusion - Local File ReadCVE-2023-26360Adobe · CVSS 8.6 · 97% likely

    Adobe

  12. Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServ…CVE-2013-0422Oracle · CVSS 9.8 · 97% likely

    Oracle

  13. Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications…CVE-2011-3544Oracle · CVSS 9.8 · 97% likely

    Oracle

  14. Triofox - Improper Access ControlCVE-2025-12480TrioFox · CVSS 9.1 · 96% likely

    TrioFox

  15. Zabbix Setup Configuration Authentication BypassCVE-2022-23134Zabbix · CVSS 3.7 · 95% likely

    Zabbix

  16. FortiClient EMS - Authentication BypassCVE-2026-35616Fortinet · CVSS 9.1 · 94% likelycovered by CyberSIXT

    FortinetThe GentlemenINC3 articles

  17. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37…CVE-2012-1723Oracle · CVSS 9.8 · 94% likely

    Oracle

  18. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and ava…CVE-2016-3427Oracle · CVSS 9.8 · 92% likely

    Oracle

  19. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, an…CVE-2012-5076Oracle · CVSS 9.8 · 91% likely

    Oracle

  20. UniFi OS - Authentication Bypass via Path Traversal (..%2f)CVE-2026-34908Ubiquiti Inc · CVSS 10 · 89% likelycovered by CyberSIXT

    Ubiquiti Inc

  21. ElasticSearch v1.1.1/1.2 RCECVE-2014-3120Elastic · CVSS 8.1 · 89% likely

    Elastic

  22. Citrix - Local File InclusionCVE-2020-8193Citrix · CVSS 6.5 · 88% likely

    Citrix (NetScaler)

  23. Joomla! JCE extension < 2.9.99.5 unauthenticated RCECVE-2026-48907joomlacontenteditor.net · CVSS 10 · 85% likelycovered by CyberSIXT

    Joomlacontenteditor.net

  24. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via…CVE-2013-2423Oracle · CVSS 3.7 · 85% likely

    Oracle

  25. Windows SMB Client Elevation of Privilege VulnerabilityCVE-2025-33073Microsoft · CVSS 8.8 · 83% likelycovered by CyberSIXT

    Microsoft

  26. Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server,…CVE-2026-21962Oracle Corporation · CVSS 10 · 73% likelycovered by CyberSIXT

    Oracle7 articles

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in