CWE-250 · Access Control
Execution with Unnecessary Privileges
369CVEs
0exploited
0with a public check
2likely (EPSS 10%+)
SortMost likely exploited
369 CVEs with CWE-250 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-1222Incorrect authorization controls in PaperCut NG/MF APIsPaperCut · PaperCut NG, PaperCut MF · CVSS 8.6 · 2024-03-14 | 8.6 | 64% | 2024-03-14 |
| CVE-2025-12420Unauthenticated Privilege Escalation in ServiceNow AI PlatformServiceNow · Now Assist AI Agents · CVSS 9.3 · 2026-01-12 | 9.3 | 53% | 2026-01-12 |
| CVE-2026-29205Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.WebPros · cPanel · CVSS 8.6 · 2026-05-13 | 8.6 | 8.4% | 2026-05-13 |
| CVE-2025-34515Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege EscalationIlevia Srl. · EVE X1 Server · CVSS 9.3 · 2025-10-16 | 9.3 | 8.4% | 2025-10-16 |
| CVE-2019-16765If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's c…github · vscode-codeql · CVSS 7.4 · 2019-11-25 | 7.4 | 5.4% | 2019-11-25 |
| CVE-2022-1808Execution with Unnecessary Privileges in polonel/trudeskpolonel · polonel/trudesk · CVSS 8.8 · 2022-05-31 | 8.8 | 3.8% | 2022-05-31 |
| CVE-2023-46360Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.Hardy-Barth · Cph2 Echarge Firmware · CVSS 8.8 · 2024-02-06 | 8.8 | 2.8% | 2024-02-06 |
| CVE-2023-39508Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesApache Software Foundation · Apache Airflow · CVSS 8.8 · 2023-08-05 | 8.8 | 2.6% | 2023-08-05 |
| CVE-2024-7387Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyRed Hat · Red Hat OpenShift Container Platform 4.12 · CVSS 9.1 · 2024-09-16 | 9.1 | 2.3% | 2024-09-16 |
| CVE-2021-1579Cisco Application Policy Infrastructure Controller App Privilege Escalation VulnerabilityCisco · Cisco Application Policy Infrastructure Controller (APIC) · CVSS 8.1 · 2021-08-25 | 8.1 | 2.1% | 2021-08-25 |
| CVE-2026-84787Privilege Escalation vulnerabilityZohocorp · ManageEngine OpManager · CVSS 8.1 · 2026-09-23 | 8.1 | 2.1% | 2026-09-23 |
| CVE-2025-34274Nagios Log Server < 2024R2.0.3 Logstash Process Root PrivilegesNagios · Log Server · CVSS 9.3 · 2025-10-30 | 9.3 | 2.1% | 2025-10-30 |
| CVE-2022-15173.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250Illumina · NextSeq 550Dx · CVSS 10 · 2022-06-24 | 10.0 | 1.9% | 2022-06-24 |
| CVE-2021-41035In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.The Eclipse Foundation · Eclipse OMR · 2021-10-25 | – | 1.8% | 2021-10-25 |
| CVE-2024-45034Apache Airflow: Authenticated DAG authors could execute code on scheduler nodesApache Software Foundation · Apache Airflow · CVSS 8.8 · 2024-09-07 | 8.8 | 1.7% | 2024-09-07 |
| CVE-2020-14493OpenClinic GAOpenclinic Ga Project · OpenClinic GA · CVSS 8.8 · 2020-07-29 | 8.8 | 1.7% | 2020-07-29 |
| CVE-2024-25421An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.Igniterealtime · Openfire · CVSS 9.8 · 2024-03-26 | 9.8 | 1.7% | 2024-03-26 |
| CVE-2023-52030TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg function.Totolink · A3700r Firmware · CVSS 9.8 · 2024-01-11 | 9.8 | 1.5% | 2024-01-11 |
| CVE-2023-2002A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unau…Linux · Kernel · 2023-05-26 | – | 1.5% | 2023-05-26 |
| CVE-2022-39286Execution with Unnecessary Privileges in JupyterAppjupyter · jupyter_core · CVSS 8.8 · 2022-10-26 | 8.8 | 1.5% | 2022-10-26 |
| CVE-2024-6913Execution with Unnecessary PrivilegesPerkinElmer · ProcessPlus · CVSS 9.3 · 2024-07-22 | 9.3 | 1.4% | 2024-07-22 |
| CVE-2024-43583Winlogon Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.8 · 2024-10-08 | 7.8 | 1.3% | 2024-10-08 |
| CVE-2023-4662RCE in Saphira ConnectSaphira · Saphira Connect · CVSS 9.8 · 2023-09-15 | 9.8 | 1.3% | 2023-09-15 |
| CVE-2018-5413Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation.Imperva · SecureSphere · 2019-01-10 | – | 1.3% | 2019-01-10 |
| CVE-2024-42024A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent…Veeam · One · CVSS 9.1 · 2024-09-07 | 9.1 | 1.3% | 2024-09-07 |
| CVE-2023-5207Execution with Unnecessary Privileges in GitLabGitLab · GitLab · CVSS 8.2 · 2023-09-30 | 8.2 | 1.2% | 2023-09-30 |
| CVE-2025-24814Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted filesApache Software Foundation · Apache Solr · CVSS 5.4 · 2025-01-27 | 5.4 | 1.2% | 2025-01-27 |
| CVE-2024-35154IBM WebSphere Application Server code executionIBM · WebSphere Application Server · CVSS 7.2 · 2024-07-09 | 7.2 | 1.2% | 2024-07-09 |
| CVE-2022-43553A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands…Ui · EdgeMAX EdgeRouter · CVSS 8.8 · 2022-12-05 | 8.8 | 1.2% | 2022-12-05 |
| CVE-2021-37174A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1),…Siemens · RUGGEDCOM ROX MX5000 · 2021-09-14 | – | 1.2% | 2021-09-14 |
| CVE-2020-2023Kata Containers - Containers have access to the guest root filesystem deviceKata Containers · Kata Containers · CVSS 3.8 · 2020-06-10 | 3.8 | 1.1% | 2020-06-10 |
| CVE-2025-5196Wing FTP Server Lua Admin Console unnecessary privilegesWing · FTP Server · CVSS 6.6 · 2025-05-26 | 6.6 | 1.1% | 2025-05-26 |
| CVE-2018-10892The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardwar…Docker · docker · CVSS 6.3 · 2018-07-06 | 6.3 | 1.1% | 2018-07-06 |
| CVE-2024-27143Pre-authenticated Remote Code ExecutionToshiba Tec Corporation · Toshiba Tec e-Studio multi-function peripheral (MFP) · CVSS 9.8 · 2024-06-14 | 9.8 | 1.1% | 2024-06-14 |
| CVE-2022-2634Digi ConnectPort X2DDigi · ConnectPort X2D · CVSS 10 · 2022-08-09 | 10.0 | 1.0% | 2022-08-09 |
| CVE-2022-40182A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.12…Siemens · Desigo PXM30-1 · 2022-10-11 | – | 1.0% | 2022-10-11 |
| CVE-2023-27010Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overw…Wondershare · Dr.fone · CVSS 7.8 · 2023-03-13 | 7.8 | 1.0% | 2023-03-13 |
| CVE-2026-69409Microsoft Office SharePoint Information Disclosure VulnerabilityMicrosoft · Microsoft SharePoint Server Subscription Edition · CVSS 6.5 · 2026-09-08 | 6.5 | 1.0% | 2026-09-08 |
| CVE-2021-3576Privilege escalation via SeImpersonatePrivilegeBitdefender · Endpoint Security Tools · CVSS 7.8 · 2021-10-28 | 7.8 | 0.9% | 2021-10-28 |
| CVE-2022-44544Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running o…Mahara · Mahara · CVSS 9.8 · 2022-11-06 | 9.8 | 0.9% | 2022-11-06 |
| CVE-2023-32080Wings vulnerable to escape to host from installation containerpterodactyl · wings · CVSS 9.1 · 2023-05-10 | 9.1 | 0.9% | 2023-05-10 |
| CVE-2023-1966CVE-2023-1966Illumina · iScan Control Software · CVSS 7.4 · 2023-04-28 | 7.4 | 0.9% | 2023-04-28 |
| CVE-2026-69464Microsoft Office SharePoint Elevation of Privilege VulnerabilityMicrosoft · Microsoft SharePoint Server Subscription Edition · CVSS 8.8 · 2026-09-08 | 8.8 | 0.9% | 2026-09-08 |
| CVE-2026-59133Microsoft High Performance Computing (HPC) Pack Elevation of Privilege VulnerabilityMicrosoft · Microsoft HPC Pack 2019 · CVSS 8.8 · 2026-08-11 | 8.8 | 0.9% | 2026-08-11 |
| CVE-2026-48584Microsoft Azure Synapse Elevation of Privilege VulnerabilityMicrosoft · Azure Synapse · CVSS 9.9 · 2026-06-19 | 9.9 | 0.9% | 2026-06-19 |
| CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumab…NodeJS · Node · CVSS 7.3 · 2024-03-19 | 7.3 | 0.9% | 2024-03-19 |
| CVE-2018-10856It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being gran…Libpod Project · podman · CVSS 5.3 · 2018-07-02 | 5.3 | 0.9% | 2018-07-02 |
| CVE-2024-21003Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u40…Oracle Corporation · Java SE JDK and JRE · CVSS 3.1 · 2024-04-16 | 3.1 | 0.9% | 2024-04-16 |
| CVE-2026-72508Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9.9 · 2026-08-12 | 9.9 | 0.8% | 2026-08-12 |
| CVE-2022-32535Web server runs as rootBosch · PRA-ES8P2S · CVSS 4.8 · 2022-06-22 | 4.8 | 0.8% | 2022-06-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.