CWE-708 · weakness in Input Validation and Logic
Incorrect Ownership Assignment
20 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.
- Webauthn tokens not removed after user has been deleted
- Nextcloud Talk not properly disassociating users from chats after account deletion
- The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password
- Incorrect Ownership Assignment in GitLab
- Incorrect Ownership Assignment in GitLab
- PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership
- Zoom Workplace Apps - Incorrect Ownership Assignment
- A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is delete…
- IBM Global Configuration Management incorrect ownership assignment
- Timing ownership claim attack on new external back-end secrets
- Incorrect Ownership Assignment in GitLab
- HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
- Philips MRI 1.5T and 3T Incorrect Ownership Assignment
- A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An att…
- Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
- Zoom Apps for macOS - Uncontrolled Resource Consumption
- Ubuntu Apport Insecure File Permissions Vulnerability
- Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
- A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An att…
- The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.