Skip to content

CWE-708 · weakness in Input Validation and Logic

Incorrect Ownership Assignment

20 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

  1. Webauthn tokens not removed after user has been deletedCVE-2021-32726nextcloud · CVSS 7.1 · 1.8% likely

    Nextcloud

  2. Nextcloud Talk not properly disassociating users from chats after account deletionCVE-2021-32689nextcloud · CVSS 8.1 · 1.0% likely

    Nextcloud

  3. The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin passwordCVE-2022-33737Openvpn · 0.9% likely

    OpenVPN

  4. Incorrect Ownership Assignment in GitLabCVE-2023-4008GitLab · CVSS 5.3 · 0.7% likely

    GitLab

  5. Incorrect Ownership Assignment in GitLabCVE-2024-9633GitLab · CVSS 3.1 · 0.5% likely

    GitLab

  6. PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownershipCVE-2026-6469Postgresql · CVSS 3.8 · 0.3% likely

    Postgresql

  7. Zoom Workplace Apps - Incorrect Ownership AssignmentCVE-2024-45426Zoom Communications, Inc · CVSS 4.9 · 0.3% likely

    Zoom Communications, Inc

  8. A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is delete…CVE-2024-52561Parallels · CVSS 7.8 · 0.3% likely

    Parallels

  9. IBM Global Configuration Management incorrect ownership assignmentCVE-2024-41773IBM · CVSS 6.5 · 0.3% likely

    IBM

  10. Timing ownership claim attack on new external back-end secretsCVE-2026-32691Canonical · CVSS 5.3 · 0.3% likely

    Canonical

  11. Incorrect Ownership Assignment in GitLabCVE-2025-5069GitLab · CVSS 3.5 · 0.3% likely

    GitLab

  12. HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access RevocationCVE-2026-40196sysadminsmedia · CVSS 8.1 · 0.2% likely

    Sysadminsmedia

  13. Philips MRI 1.5T and 3T Incorrect Ownership AssignmentCVE-2021-26248Philips · CVSS 5.9 · 0.2% likely

    Philips

  14. A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An att…CVE-2023-20043Cisco · CVSS 6.7 · 0.2% likely

    Cisco

  15. Jobs can be saved as workflows with wrong permissions on KNIME Business HubCVE-2025-14262KNIME · CVSS 5.3 · 0.2% likely

    KNIME

  16. Zoom Apps for macOS - Uncontrolled Resource ConsumptionCVE-2024-45417Zoom Communications, Inc · CVSS 6 · 0.2% likely

    Zoom Communications, Inc

  17. Ubuntu Apport Insecure File Permissions VulnerabilityCVE-2025-5467Canonical · CVSS 1.9 · 0.2% likely

    Canonical

  18. Incorrect file ownership of privileged service's libraries in Enel X JuiceBoxCVE-2023-29122Enel X · CVSS 6.7 · 0.2% likely

    Enel X

  19. A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An att…CVE-2023-20044Cisco · CVSS 6.7 · 0.1% likely

    Cisco

  20. The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.CVE-2026-110452NixOS · CVSS 4 · 0.1% likely

    NixOS

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in