Skip to content
BackEsc
Sign in

connection · two weakness classes

Access Control with Misconfiguration and Insecure Design

86 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy: this is what the line between them on the dial stands for.

exploited in the wild
1
check available
4

Every one of the 86 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional…CVE-2026-58704Google · CVSS 8.8 · 0.6% likelycovered by CyberSIXT

    CWE-693Google8 articles

  2. PraisonAI - Authentication BypassCVE-2026-44338MervinPraison · CVSS 7.3 · 33% likelycovered by CyberSIXT

    CWE-306MervinPraison

  3. Paperclip - Remote Code ExecutionCVE-2026-41679paperclipai · CVSS 10 · 32% likelycovered by CyberSIXT

    CWE-287

  4. OpenCode < 1.0.216 - Unauthenticated Remote Code ExecutionCVE-2026-22812anomalyco · CVSS 8.8 · 17% likely

    CWE-306

  5. New API < v0.12.10 - Stripe Webhook BypassCVE-2026-41432QuantumNous · CVSS 7.1 · 0.9% likely

    CWE-345QuantumNous

  6. sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which…CVE-2009-06419.3% likely

    CWE-16

  7. Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.CVE-2013-43168.4% likely

    CWE-16

  8. The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick oper…CVE-2004-26924.5% likely

    CWE-16

  9. A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.7 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware b…CVE-2018-102514.4% likely

    CWE-862

  10. Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativ…CVE-2007-53383.2% likely

    CWE-16

  11. moby/moby's dockerd daemon encrypted overlay network may be unauthenticatedCVE-2023-28840moby · CVSS 7.5 · 2.6% likely

    CWE-420Moby

  12. Quick Look Apple Mac OS X 10.5.1, when previewing an HTML file, does not prevent plug-ins from making network requests, which might allow remote attackers to obtain sensitive info…CVE-2007-58562.4% likely

    CWE-16

  13. Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrat…CVE-2009-03992.3% likely

    CWE-16

  14. The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authen…CVE-2010-40212.1% likely

    CWE-16

  15. install.php in JCE-Tech PHP Calendars, downloaded 20100121, allows remote attackers to bypass intended access restrictions and modify application settings via a direct request. NO…CVE-2010-03802.0% likely

    CWE-16

  16. Nx: `nx graph` dev server permissive CORS policyCVE-2026-54753nrwl · CVSS 5.9 · 1.4% likely

    CWE-749Nrwl

  17. moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedCVE-2023-28842moby · CVSS 6.8 · 1.4% likely

    CWE-420Moby

  18. The ASUS WL-330NUL router has a configuration process that relies on accessing the 192.168.1.1 IP address, but the documentation advises users to instead access a DNS hostname tha…CVE-2013-72931.1% likely

    CWE-16

  19. PraisonAI MCPServer exposes unauthenticated HTTP tools/callCVE-2026-57139MervinPraison · CVSS 9.8 · 0.8% likely

    CWE-306MervinPraison

  20. Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsCVE-2024-25124gofiber · CVSS 9.4 · 0.7% likely

    CWE-346Gofiber

  21. Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)CVE-2026-103091Google · CVSS 9.3 · 0.6% likely

    CWE-862Google

  22. An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, t…CVE-2025-43413Apple · CVSS 7.5 · 0.6% likely

    CWE-693Apple

  23. Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist forCVE-2026-77560tinyauthapp · CVSS 8.1 · 0.6% likely

    CWE-178

  24. .NET Security Feature Bypass VulnerabilityCVE-2026-50528Microsoft · CVSS 8.2 · 0.6% likely

    CWE-863Microsoft

  25. A2A Java SDK has a fail-open default task authorizationCVE-2026-111764a2aproject · CVSS 7.5 · 0.6% likely

    CWE-862A2aproject

  26. Appsmith: Caddy admin API exposed without authenticationCVE-2026-55454appsmithorg · CVSS 9.9 · 0.6% likely

    CWE-749Appsmithorg

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in