CWE-283 · Access Control
Unverified Ownership
36CVEs
SortMost likely exploited
36 CVEs with CWE-283 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-27903OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact…OpenVPN · OpenVPN 2 · CVSS 7.2 · 2024-07-08 | 7.2 | 8.9% | 2024-07-08 |
| CVE-2020-8554Kubernetes man in the middle using LoadBalancer or ExternalIPsKubernetes · Kubernetes · CVSS 6.3 · 2021-01-21 | 6.3 | 8.7% | 2021-01-21 |
| CVE-2021-24501Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsAmentotech · Workreap · 2021-08-09 | – | 1.3% | 2021-08-09 |
| CVE-2021-24500Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesAmentotech · Workreap · 2021-08-09 | – | 0.6% | 2021-08-09 |
| CVE-2025-1007Improper Authorization in /user/namespace/{namespace}/detailsEclipse Foundation · OpenVSX · CVSS 6.9 · 2025-02-19 | 6.9 | 0.5% | 2025-02-19 |
| CVE-2022-29220No verification of commits origin in github-action-merge-dependabotfastify · github-action-merge-dependabot · CVSS 6.5 · 2022-05-31 | 6.5 | 0.5% | 2022-05-31 |
| CVE-2025-47940TYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerTYPO3 · typo3 · CVSS 7.2 · 2025-05-20 | 7.2 | 0.5% | 2025-05-20 |
| CVE-2026-85781Unverified access point ownership in Amazon EFS CSI Driveraws · aws-efs-csi-driver · CVSS 8.7 · 2026-09-04 | 8.7 | 0.4% | 2026-09-04 |
| CVE-2026-87913Missing S3 bucket ownership verification in the AWS Security Agent MCP serverAWS · AWS Security Agent MCP server · CVSS 5.9 · 2026-09-10 | 5.9 | 0.4% | 2026-09-10 |
| CVE-2026-87912Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecopsAWS · AWS Security Agent plugin · CVSS 5.9 · 2026-09-10 | 5.9 | 0.4% | 2026-09-10 |
| CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified onekiwitcms · Kiwi · CVSS 3.9 · 2023-04-24 | 3.9 | 0.4% | 2023-04-24 |
| CVE-2025-36091IBM Business Automation Insights unverified ownershipIBM · Cloud Pak For Business Automation · CVSS 4.3 · 2025-11-03 | 4.3 | 0.4% | 2025-11-03 |
| CVE-2026-44707Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accountschatwoot · chatwoot · CVSS 6.8 · 2026-05-26 | 6.8 | 0.3% | 2026-05-26 |
| CVE-2023-6068On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a…Arista Networks · MOS · CVSS 3.1 · 2024-03-04 | 3.1 | 0.3% | 2024-03-04 |
| CVE-2026-9745Vulnerabilities exists in IBM Netezza SoftwareIBM · Netezza Software · CVSS 6.5 · 2026-09-03 | 6.5 | 0.3% | 2026-09-03 |
| CVE-2026-27486OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanupopenclaw · openclaw · CVSS 4.3 · 2026-02-21 | 4.3 | 0.3% | 2026-02-21 |
| CVE-2026-83791Windows Virtual Input Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2026-10-13 | 7.8 | 0.3% | 2026-10-13 |
| CVE-2025-12815An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote us…AWS · Research and Engineering Studio (RES) · CVSS 4.3 · 2025-11-06 | 4.3 | 0.3% | 2025-11-06 |
| CVE-2026-29788TSPortal: Anyone can forge self-deletion requests of any usermiraheze · TSPortal · CVSS 8.4 · 2026-03-06 | 8.4 | 0.3% | 2026-03-06 |
| CVE-2026-88233Windows Task Scheduler Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-11-10 | 7.8 | 0.3% | 2026-11-10 |
| CVE-2026-0598Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiRed Hat · Red Hat Ansible Automation Platform 2.6 · CVSS 4.2 · 2026-02-06 | 4.2 | 0.2% | 2026-02-06 |
| CVE-2025-9822Secret data extraction via elfinderMautic · Mautic · CVSS 5.5 · 2025-09-03 | 5.5 | 0.2% | 2025-09-03 |
| CVE-2026-93853Barman snapshot backup deletion trusts unverified backup catalog metadataEnterpriseDB · Barman · CVSS 7.2 · 2026-09-29 | 7.2 | 0.2% | 2026-09-29 |
| CVE-2026-127119Unverified ownership of the default EMR cluster log location in AWS SDK for pandasAWS · aws-sdk-pandas · CVSS 5.3 · 2026-11-12 | 5.3 | 0.2% | 2026-11-12 |
| CVE-2024-1853Zemana AntiLogger v2.74.204.664 - Arbitrary Process TerminationZemena · AntiLogger · CVSS 5.5 · 2024-03-14 | 5.5 | 0.2% | 2024-03-14 |
| CVE-2026-54467On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.TrustedFirmware · Trusted Firmware-M · CVSS 7 · 2026-08-26 | 7.0 | 0.2% | 2026-08-26 |
| CVE-2026-118029Unverified ownership of the default Athena query result location in AWS SDK for pandasaws · aws-sdk-pandas · CVSS 5.9 · 2026-10-28 | 5.9 | 0.2% | 2026-10-28 |
| CVE-2025-24890gix-sec safe.directory protections absent for elevated administratorsGitoxideLabs · gitoxide · CVSS 6.8 · 2026-09-14 | 6.8 | 0.2% | 2026-09-14 |
| CVE-2026-40337Sentry kernel has incomplete ownership check for IRQ line manipulationcamelot-os · sentry-kernel · CVSS 5.1 · 2026-04-17 | 5.1 | 0.2% | 2026-04-17 |
| CVE-2025-29940Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a malicious hypervisor to overwrite guest memory if segment…AMD · AMD EPYC™ 9005 Series Processors · CVSS 5.9 · 2026-11-10 | 5.9 | 0.2% | 2026-11-10 |
| CVE-2026-110237Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Executionvifm · vifm · CVSS 7.3 · 2026-10-13 | 7.3 | 0.1% | 2026-10-13 |
| CVE-2026-112911filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusiontox-dev · filelock · CVSS 6.3 · 2026-10-20 | 6.3 | 0.1% | 2026-10-20 |
| CVE-2026-84386A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via via…Fortinet · FortiClientWindows · CVSS 4.7 · 2026-09-08 | 4.7 | 0.1% | 2026-09-08 |
| CVE-2025-43882Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged attacker could potentially exploit this vulnerability leadin…Dell · ThinOS 10 · CVSS 7.8 · 2025-08-27 | 7.8 | 0.1% | 2025-08-27 |
| CVE-2026-15599Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joinerTÜBİTAK BİLGEM Software Technologies Research Institute · pardus-domain-joiner · CVSS 3.3 · 2026-08-06 | 3.3 | 0.1% | 2026-08-06 |
| CVE-2026-126624Unverified Ownership in hMailServerProgressive Robot Ltd · hMailServer · CVSS 7.3 · 2026-11-11 | 7.3 | 0.1% | 2026-11-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.