CWE-279 · Access Control
Incorrect Execution-Assigned Permissions
25CVEs
SortMost likely exploited
25 CVEs with CWE-279 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-4665Privilage Escalation in Saphira ConnectSaphira · Saphira Connect · CVSS 8.8 · 2023-09-15 | 8.8 | 1.1% | 2023-09-15 |
| CVE-2024-37734An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.Open-Emr · Openemr · CVSS 9.8 · 2024-06-26 | 9.8 | 0.8% | 2024-06-26 |
| CVE-2017-8441Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted perm…Elastic · X-Pack Security · 2017-06-05 | – | 0.7% | 2017-06-05 |
| CVE-2023-50914A Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authentictaed users to change the DACL of arbitr…No vendor recorded · CVSS 6.7 · 2024-04-30 | 6.7 | 0.7% | 2024-04-30 |
| CVE-2023-3915Incorrect Execution-Assigned Permissions in GitLabGitLab · GitLab · CVSS 6.5 · 2023-09-01 | 6.5 | 0.7% | 2023-09-01 |
| CVE-2025-30001Apache StreamPark: Authenticated users can trigger remote command executionApache Software Foundation · Apache StreamPark · CVSS 7.3 · 2025-10-10 | 7.3 | 0.6% | 2025-10-10 |
| CVE-2025-12801Nfs-utils: rpc.mountd in the nfs-utils privilege escalationRed Hat · Red Hat Enterprise Linux 10 · CVSS 6.5 · 2026-03-04 | 6.5 | 0.5% | 2026-03-04 |
| CVE-2020-8025outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issuesSUSE · SUSE Linux Enterprise Server 12-SP4 · CVSS 6.1 · 2020-08-07 | 6.1 | 0.5% | 2020-08-07 |
| CVE-2025-14025Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsRed Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · CVSS 8.5 · 2026-01-08 | 8.5 | 0.4% | 2026-01-08 |
| CVE-2025-58437Coder's privilege escalation vulnerability could lead to a cross workspace compromisecoder · coder · CVSS 8.1 · 2025-09-06 | 8.1 | 0.4% | 2025-09-06 |
| CVE-2023-4383MicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissionsMicroWorld · eScan Anti-Virus · CVSS 7.8 · 2023-08-16 | 7.8 | 0.3% | 2023-08-16 |
| CVE-2024-39286Incorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R) 800 Series Ethernet Driver before version 1.15.4 may allow an authenticated user to poten…Intel(R) 800 Series Ethernet Driver · CVSS 3.3 · 2025-02-12 | 3.3 | 0.2% | 2025-02-12 |
| CVE-2025-20612Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of…Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 5.5 · 2025-05-13 | 5.5 | 0.2% | 2025-05-13 |
| CVE-2025-36228Incorrect Execution-Assigned Permissions in IBM Aspera FaspexIBM · Aspera Faspex 5 · CVSS 3.8 · 2025-12-26 | 3.8 | 0.2% | 2025-12-26 |
| CVE-2025-23233Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of…Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 3.5 · 2025-05-13 | 3.5 | 0.2% | 2025-05-13 |
| CVE-2025-23263NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of service on the VLAN.NVIDIA · DOCA-Host and Mellanox OFED · CVSS 7.6 · 2025-07-17 | 7.6 | 0.2% | 2025-07-17 |
| CVE-2024-25621containerd affected by a local privilege escalation via wide permissions on CRI directorycontainerd · containerd · CVSS 7.3 · 2025-11-06 | 7.3 | 0.2% | 2025-11-06 |
| CVE-2024-11220Open Automation Software Incorrect Execution-Assigned PermissionsOpen Automation Software · Open Automation Software · CVSS 7.8 · 2024-12-06 | 7.8 | 0.2% | 2024-12-06 |
| CVE-2024-37025Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 may allow an authenticated user to poten…Intel(R) Advanced Link Analyzer Standard Edition software installer · CVSS 6.7 · 2024-11-13 | 6.7 | 0.1% | 2024-11-13 |
| CVE-2025-22843Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of…Edge Orchestrator software for Intel(R) Tiber™ Edge Platform · CVSS 7.8 · 2025-05-13 | 7.8 | 0.1% | 2025-05-13 |
| CVE-2026-20062A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administr…Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · CVSS 7.2 · 2026-03-04 | 7.2 | 0.1% | 2026-03-04 |
| CVE-2026-4948Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorizationRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.5 · 2026-03-27 | 5.5 | 0.1% | 2026-03-27 |
| CVE-2026-46388osquery: Unprivileged users can temporarily read file carve contentsosquery · osquery · CVSS 4.4 · 2026-07-10 | 4.4 | 0.1% | 2026-07-10 |
| CVE-2025-13663Quartus Prime Pro Edition Installer AdvisoryAltera · Quartus Prime Pro · CVSS 6.7 · 2025-12-11 | 6.7 | 0.1% | 2025-12-11 |
| CVE-2025-26422In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escala…Google · Android · CVSS 4 · 2025-09-04 | 4.0 | 0.1% | 2025-09-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.