Skip to content
BackEsc
Sign in

CWE-285 · weakness in Access Control

Improper Authorization

1,133 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
9
likely to be exploited
10

Every one of the 1,133 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. QNAP HBS 3 - Broken Access ControlCVE-2021-28799QNAP Systems Inc. · CVSS 10 · 78% likely

    QNAP

  2. Next.js Middleware BypassCVE-2025-29927vercel · CVSS 9.1 · 99% likelycovered by CyberSIXT

    VercelTeamPCP

  3. XWiki < 4.10.15 - Information DisclosureCVE-2023-48241xwiki · CVSS 7.5 · 73% likely

    Xwiki

  4. KubeOperator Foreground `kubeconfig` - File DownloadCVE-2023-22480KubeOperator · CVSS 7.3 · 67% likely
  5. Modoboa < 2.1.0 - Improper AuthorizationCVE-2023-2227modoboa · CVSS 9.1 · 44% likely

    Modoboa

  6. Cisco RV110W RV130W RV215W Router - Information leakageCVE-2019-1898Cisco · CVSS 5.3 · 41% likely

    Cisco

  7. TOTOLINK EX1800T TOTOLINK EX1800T - Command InjectionCVE-2024-34257Totolink · CVSS 9.8 · 3.8% likely

    TOTOLINK

  8. Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account TakeoverCVE-2026-10580hippooo · CVSS 9.8 · 2.9% likely

    Hippooo

  9. IP2Location Country Blocker < 2.38.9 - Unauthenticated Information DisclosureCVE-2025-1361ip2location · CVSS 7.5 · 1.3% likely

    IP2Location

  10. Avid NEXIS Agent - Arbitrary File ReadCVE-2024-26291Avid · CVSS 8.7 · 1.2% likely
  11. ‘edit_user’ Capability Privilege EscalationCVE-2023-32707Splunk · CVSS 8.8 · 79% likely

    Splunk

  12. Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable…CVE-2022-3229Unified Intents AB · CVSS 9.8 · 66% likely
  13. cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the…CVE-2016-567654% likely
  14. Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2025-21400Microsoft · CVSS 8 · 34% likely

    Microsoft

  15. glpi Users emails enumerationCVE-2024-27937glpi-project · CVSS 6.5 · 27% likely

    GLPI

  16. Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for remote attackers to de…CVE-2016-335221% likely
  17. Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansCVE-2023-50780Apache Software Foundation · CVSS 8.8 · 17% likely

    Apache

  18. Cisco Small Business 220 Series Smart Switches Authentication Bypass VulnerabilityCVE-2019-1912Cisco · CVSS 9.1 · 17% likely

    Cisco

  19. Cisco Identity Services Engine Insufficient Authorization Bypass VulnerabilityCVE-2025-20125Cisco · CVSS 9.1 · 16% likely

    Cisco

  20. curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of th…CVE-2016-542015% likely
  21. The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call v…CVE-2016-50638.4% likely
  22. Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by le…CVE-2016-45318.2% likely
  23. A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack a…CVE-2017-11398Trend Micro · 8.2% likely

    Trend Micro

  24. SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication BypassCVE-2022-0993siteground · CVSS 8.1 · 7.5% likely

    SiteGround

  25. 4MOSAn GCB Doctor - Improper AuthorizationCVE-2021-423384MOSAn · CVSS 9.8 · 5.8% likely
  26. A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version…CVE-2019-7489SonicWall · 5.3% likely

    SonicWall

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in