Skip to content
BackEsc
Sign in

CWE-732 · weakness in Access Control

Incorrect Permission Assignment for Critical Resource

1,585 CVEs · 3 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
3
check available
7
likely to be exploited
17

Every one of the 1,585 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\v…CVE-2019-15752Docker · CVSS 7.8 · 49% likely

    Docker

  2. A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials c…CVE-2018-13374Fortinet · CVSS 4.3 · 38% likely

    Fortinet

  3. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious acto…CVE-2022-22960VMware · CVSS 7.8 · 36% likely

    VMware

  4. Loytec LGATE-902 <6.4.2 - Local File InclusionCVE-2018-1491617% likely
  5. Cobbler - Authentication BypassCVE-2018-100022613% likely
  6. Seagate NAS OS 4.3.15.1 - Server Information DisclosureCVE-2018-1229611% likely
  7. Jeecg Boot <= 2.4.5 - Information DisclosureCVE-2021-37304CVSS 7.5 · 4.0% likely
  8. Canon Devices - Authentication Bypass in Catwalk ServerCVE-2021-381544.0% likely
  9. Jeecg Boot <= 2.4.5 - Sensitive Information DisclosureCVE-2021-37305CVSS 7.5 · 3.5% likely
  10. FileGator < 7.14.2 - Privilege EscalationCVE-2026-63358FileGator · CVSS 7.3 · 0.5% likely

    FileGator

  11. Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.CVE-2011-3923Apache · 89% likely

    Apache

  12. MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating…CVE-2018-100020764% likely
  13. Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Ite…CVE-2023-32986Jenkins Project · CVSS 8.8 · 61% likely

    Jenkins

  14. Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passwords, etc.) allows r…CVE-2017-1688533% likely
  15. Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and o…CVE-2010-0488CVSS 6.5 · 29% likely
  16. An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The EmbeddedAceSet_Tas…CVE-2018-4072Sierra Wireless · 26% likely
  17. An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID…CVE-2020-0668Microsoft · 26% likely

    Microsoft

  18. An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The the binary the end…CVE-2018-4073Sierra Wireless · 26% likely
  19. An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini f…CVE-2020-1110722% likely
  20. Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical ResourceCVE-2022-43773Hitachi Vantara · CVSS 8.8 · 22% likely

    Hitachi Vantara

  21. In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a re…CVE-2017-946222% likely
  22. Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as rootCVE-2026-21902Juniper Networks · CVSS 9.8 · 18% likelycovered by CyberSIXT

    Juniper Networks

  23. Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a…CVE-2021-21177Google · 17% likely

    Google

  24. The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authenticatio…CVE-2018-1028513% likely
  25. Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify…CVE-2017-1786711% likely
  26. Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative Cloud desktop applications.CVE-2017-3006Adobe Thor 3.9.5.353 and earlier. · 11% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in