Skip to content
BackEsc
Sign in

CWE-863 · weakness in Access Control

Incorrect Authorization

4,225 CVEs · 20 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
20
check available
35
likely to be exploited
43

Every one of the 4,225 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Atlassian Confluence Server - Improper AuthorizationCVE-2023-22518Atlassian · CVSS 10 · 100% likely

    Atlassian

  2. Ivanti Sentry - Authentication BypassCVE-2023-38035Ivanti · CVSS 9.8 · 100% likely

    Ivanti

  3. Apache OFBiz - Improper Authorization & Remote Code ExecutionCVE-2024-38856Apache Software Foundation · CVSS 8.1 · 99% likely

    Apache

  4. Adobe Commerce/Magento - Customer Session Identity SwitchCVE-2026-71362Adobe · CVSS 9.1 · 92% likelycovered by CyberSIXT

    Adobe4 articles

  5. QNAP QTS and Photo Station 6.0.3 - Remote Command ExecutionCVE-2019-7192QNAP · CVSS 9.8 · 88% likely

    QNAP

  6. D-Link DIR-605 - Information DisclosureCVE-2021-40655D-Link · CVSS 7.5 · 87% likely

    D-Link

  7. An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7…CVE-2018-13382Fortinet · CVSS 9.1 · 82% likely

    Fortinet

  8. Adobe Experience Manager | Incorrect Authorization (CWE-863)CVE-2025-54253Adobe · CVSS 10 · 81% likely

    Adobe

  9. Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-24880Microsoft · CVSS 4.4 · 78% likely

    Microsoft

  10. It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be u…CVE-2021-3560Red Hat · CVSS 7.8 · 22% likely

    Red Hat

  11. Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.CVE-2021-30533Google · CVSS 6.5 · 17% likely

    Google

  12. Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.7…CVE-2025-55177Facebook · CVSS 5.4 · 14% likelycovered by CyberSIXT

    Meta (Facebook)

  13. Microsoft Publisher Security Feature Bypass VulnerabilityCVE-2023-21715Microsoft · CVSS 7.3 · 12% likely

    Microsoft

  14. JFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope BypassCVE-2026-42016jfrog · CVSS 8.1 · 8.6% likelycovered by CyberSIXT

    JFrog8 articles

  15. An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.…CVE-2025-24200Apple · CVSS 6.1 · 4.5% likelycovered by CyberSIXT

    Apple1 article

  16. Windows Mark of the Web Security Feature Bypass VulnerabilityCVE-2022-41091Microsoft · CVSS 5.4 · 2.3% likely

    Microsoft

  17. Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is…CVE-2024-21287Oracle Corporation · CVSS 7.5 · 1.7% likely

    Oracle

  18. Incorrect Authorization in GraphicsCVE-2025-21479Qualcomm, Inc. · CVSS 8.6 · 0.8% likely

    Qualcomm, Inc.

  19. IBM Aspera Faspex Authorization BypassCVE-2026-123218IBM · CVSS 9.8 · 0.5% likelycovered by CyberSIXT

    IBM5 articles5 articles this week: CISA adds four exploited software flaws to its KEV catalogue

  20. Incorrect Authorization in Graphics WindowsCVE-2025-21480Qualcomm, Inc. · CVSS 8.6 · 0.4% likely

    Qualcomm, Inc.

  21. Jira Server and Data Center - Information DisclosureCVE-2020-36289Atlassian · CVSS 5.3 · 99% likely

    Atlassian

  22. Calibre <= 7.14.0 Remote Code ExecutionCVE-2024-6782Calibre · CVSS 9.8 · 84% likely
  23. Apache Druid - Local File InclusionCVE-2021-36749Apache Software Foundation · 81% likely

    Apache

  24. WordPress WPS Hide Login <1.9.1 - Information DisclosureCVE-2021-24917WPS Hide Login · 72% likely
  25. Jira - Incorrect AuthorizationCVE-2019-3403Atlassian · 54% likely

    Atlassian

  26. Arcserve UDP <= 9.0.6034 - Authentication BypassCVE-2023-2625840% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in