CWE-862 · weakness in Access Control
Missing Authorization
11,114 CVEs · 11 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 11
- check available
- 123
- likely to be exploited
- 27
Every one of the 11,114 is a mark on the map. Named now: 1 to 26, most at risk first.
- Redis Sandbox Escape - Remote Code Execution
- Digiever DS-2105 Pro - Command Injection
- Cisco Secure Firewall ASA & FTD - Authentication Bypass
- A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gateke…
- DELMIA Apriso - Broken Access Control
- SimpleHelp <= 5.5.7 - Privilege Escalation
- Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a craft…
- A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is…
- A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
- Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket
Check Point4 articles4 articles this week: CISA adds Check Point firewall flaw allowing local users root access to KEV
- ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise7 articles2 articles this week: SCKit worm abuses ScreenConnect to target MSP technicians
- VMware View Planner <4.6 SP1- Remote Code Execution
- Elementor Website Builder - Remote Code Execution
- Lucee Admin - Remote Code Execution
- WordPress InfiniteWP <1.9.4.5 - Authorization Bypass
- ZoneMinder Snapshots - Command Injection
- Apache ShenYu Admin Unauth Access
- WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval
- Control Web Panel (CWP) - File Inclusion
- AudioCodes 420HD - Remote Code Execution
- Maian Cart <=3.8 - Remote Code Execution
- HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route
- Post SMTP <= 3.6.0 - Email Log Disclosure
- Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
- Unauthenticated Arbitrary Plugin Upload in Alone Theme
- Metersphere - Arbitrary File Read
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.