CWE-566 · weakness in Insecure Direct Object Reference
Authorization Bypass Through User-Controlled SQL Primary Key
10 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.
- Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is expl…
- In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify…
- SQL Injection in Harbor scan log API
- SQLi in Database Software's Databank Accreditation Software
- Zulip allows the deletion of organization by administrators of a different organization
- MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
- Zulip allows the deletion of Custom profile fields by administrators of a different organization
- OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
- GraphQL IDOR allows authenticated user to delete workspace content of other users
- An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel -…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.