CWE-284 · Access Control
Improper Access Control
7,485CVEs
34exploited
32with a public check
88likely (EPSS 10%+)
SortMost likely exploited
7,485 CVEs with CWE-284 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-27350In CISA KEVExploitedPaperCut - Unauthenticated Remote Code ExecutionPaperCut · NG · CVSS 9.8 · 2023-04-20 | 9.8 | 100% | 2023-04-20 |
| CVE-2019-1653In CISA KEVExploitedCisco Small Business WAN VPN Routers - Sensitive Information DisclosureCisco · Cisco Small Business RV Series Router Firmware · CVSS 7.5 · 2019-01-24 | 7.5 | 100% | 2019-01-24 |
| CVE-2023-23752In CISA KEVExploitedJoomla! Webservice - Password DisclosureJoomla! Project · Joomla! CMS · CVSS 5.3 · 2023-02-16 | 5.3 | 100% | 2023-02-16 |
| CVE-2023-38205In CISA KEVExploitedAdobe ColdFusion - Access Control BypassAdobe · ColdFusion · CVSS 7.5 · 2023-09-14 | 7.5 | 100% | 2023-09-14 |
| CVE-2023-29298In CISA KEVExploitedAdobe ColdFusion - Access Control BypassAdobe · ColdFusion · CVSS 7.5 · 2023-07-12 | 7.5 | 100% | 2023-07-12 |
| CVE-2015-3306In CISA KEVExploitedProFTPd - Remote Code ExecutionProFTPD · ProFTPD · CVSS 10 · 2015-05-18 | 10.0 | 99% | 2015-05-18 |
| CVE-2024-27348In CISA KEVExploitedApache HugeGraph-Server - Remote Command ExecutionApache Software Foundation · Apache HugeGraph-Server · CVSS 9.8 · 2024-04-22 | 9.8 | 99% | 2024-04-22 |
| CVE-2012-4681In CISA KEVExploitedMultiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted ap…Oracle · Java SE · CVSS 9.8 · 2012-08-28 | 9.8 | 99% | 2012-08-28 |
| CVE-2024-20767In CISA KEVExploitedAdobe ColdFusion - Arbitrary File ReadAdobe · ColdFusion · CVSS 7.4 · 2024-03-18 | 7.4 | 99% | 2024-03-18 |
| CVE-2023-24489In CISA KEVExploitedCitrix ShareFile StorageZones Controller - Unauthenticated Remote Code ExecutionCitrix · Citrix ShareFile Storage Zones Controller · CVSS 9.8 · 2023-07-10 | 9.8 | 97% | 2023-07-10 |
| CVE-2023-26360In CISA KEVExploitedAdobe ColdFusion - Local File ReadAdobe · ColdFusion · CVSS 8.6 · 2023-03-23 | 8.6 | 97% | 2023-03-23 |
| CVE-2013-0422In CISA KEVExploitedMultiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServ…Oracle · Java Runtime Environment (JRE) · CVSS 9.8 · 2013-01-10 | 9.8 | 97% | 2013-01-10 |
| CVE-2011-3544In CISA KEVExploitedUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications…Oracle · Java SE JDK and JRE · CVSS 9.8 · 2011-10-19 | 9.8 | 97% | 2011-10-19 |
| CVE-2025-12480In CISA KEVExploitedTriofox - Improper Access ControlTrioFox · TrioFox · CVSS 9.1 · 2025-11-10 | 9.1 | 96% | 2025-11-10 |
| CVE-2022-23134In CISA KEVExploitedZabbix Setup Configuration Authentication BypassZabbix · Frontend · CVSS 3.7 · 2022-01-13 | 3.7 | 95% | 2022-01-13 |
| CVE-2026-35616In CISA KEVExploitedFortiClient EMS - Authentication BypassFortinet · FortiClientEMS · CVSS 9.1 · 2026-04-04 | 9.1 | 94% | 2026-04-04 |
| CVE-2012-1723In CISA KEVExploitedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37…Oracle · Java SE · CVSS 9.8 · 2012-06-16 | 9.8 | 94% | 2012-06-16 |
| CVE-2016-3427In CISA KEVExploitedUnspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and ava…Oracle · Java SE and JRockit · CVSS 9.8 · 2016-04-21 | 9.8 | 92% | 2016-04-21 |
| CVE-2012-5076In CISA KEVExploitedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, an…Oracle · Java SE · CVSS 9.8 · 2012-10-16 | 9.8 | 91% | 2012-10-16 |
| CVE-2026-34908In CISA KEVExploitedUniFi OS - Authentication Bypass via Path Traversal (..%2f)Ubiquiti Inc · UniFi OS Server · CVSS 10 · 2026-05-22 | 10.0 | 89% | 2026-05-22 |
| CVE-2014-3120In CISA KEVExploitedElasticSearch v1.1.1/1.2 RCEElastic · Elasticsearch · CVSS 8.1 · 2014-07-28 | 8.1 | 89% | 2014-07-28 |
| CVE-2020-8193In CISA KEVExploitedCitrix - Local File InclusionCitrix · Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP · CVSS 6.5 · 2020-07-10 | 6.5 | 88% | 2020-07-10 |
| CVE-2026-48907In CISA KEVExploitedJoomla! JCE extension < 2.9.99.5 unauthenticated RCEjoomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla · CVSS 10 · 2026-06-05 | 10.0 | 85% | 2026-06-05 |
| CVE-2013-2423In CISA KEVExploitedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via…Oracle · Java Runtime Environment (JRE) · CVSS 3.7 · 2013-04-17 | 3.7 | 85% | 2013-04-17 |
| CVE-2025-33073In CISA KEVExploitedWindows SMB Client Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 8.8 · 2025-06-10 | 8.8 | 83% | 2025-06-10 |
| CVE-2026-21962In CISA KEVExploitedVulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server,…Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in · CVSS 10 · 2026-01-20 | 10.0 | 73% | 2026-01-20 |
| CVE-2021-22941In CISA KEVExploitedImproper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.Citrix · Citrix ShareFile storage zones controller · CVSS 9.8 · 2021-09-23 | 9.8 | 54% | 2021-09-23 |
| CVE-2020-8196In CISA KEVExploitedImproper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1…Citrix · Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP · CVSS 4.3 · 2020-07-10 | 4.3 | 26% | 2020-07-10 |
| CVE-2024-40766In CISA KEVExploitedAn improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific condit…SonicWall · SonicOS · CVSS 9.3 · 2024-08-23 | 9.3 | 18% | 2024-08-23 |
| CVE-2015-4902In CISA KEVExploitedUnspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.Oracle · Java SE · CVSS 5.3 · 2015-10-21 | 5.3 | 14% | 2015-10-21 |
| CVE-2019-11634In CISA KEVExploitedCitrix Workspace App before 1904 for Windows has Incorrect Access Control.Citrix · Workspace Application and Receiver for Windows · CVSS 9.8 · 2019-05-22 | 9.8 | 8.1% | 2019-05-22 |
| CVE-2025-59230In CISA KEVExploitedWindows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.8 · 2025-10-14 | 7.8 | 2.7% | 2025-10-14 |
| CVE-2020-2506In CISA KEVExploitedimproper access control vulnerability in HelpdeskQNAP Systems Inc. · Helpdesk · CVSS 7.3 · 2021-02-03 | 7.3 | 2.0% | 2021-02-03 |
| CVE-2025-24989In CISA KEVExploitedMicrosoft Power Pages Elevation of Privilege VulnerabilityMicrosoft · Microsoft Power Pages · CVSS 8.2 · 2025-02-19 | 8.2 | 1.6% | 2025-02-19 |
| CVE-2022-0824CheckWebmin <1.990 - Improper Access Controlwebmin · webmin/webmin · CVSS 8.3 · 2022-03-02 | 8.3 | 97% | 2022-03-02 |
| CVE-2019-2729CheckOracle WebLogic Server Administration Console - Remote Code ExecutionOracle Corporation · WebLogic Server · CVSS 9.8 · 2019-06-19 | 9.8 | 89% | 2019-06-19 |
| CVE-2023-22232CheckAdobe Connect < 12.1.5 - Local File DisclosureAdobe · Connect · CVSS 5.3 · 2023-02-17 | 5.3 | 83% | 2023-02-17 |
| CVE-2022-31704CheckVMware vRealize Log Insight - Improper Access Control to RCEVmware · vRealize Log Insight (vRLI) · CVSS 9.8 · 2023-01-25 | 9.8 | 81% | 2023-01-25 |
| CVE-2024-25723CheckZenML ZenML Server - Improper AuthenticationZenml · Zenml · CVSS 8.8 · 2024-02-27 | 8.8 | 71% | 2024-02-27 |
| CVE-2023-4169CheckRuijie RG-EW1200G Router - Password ResetRuijie · RG-EW1200G · CVSS 6.3 · 2023-08-05 | 6.3 | 54% | 2023-08-05 |
| CVE-2015-3224CheckRuby on Rails Web Console - Remote Code ExecutionRubyonrails · Web Console · 2015-07-26 | – | 49% | 2015-07-26 |
| CVE-2024-21644CheckpyLoad Flask Config - Access Controlpyload · pyload · CVSS 7.5 · 2024-01-08 | 7.5 | 42% | 2024-01-08 |
| CVE-2021-24146CheckWordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information DisclosureWebnus · Modern Events Calendar Lite · 2021-03-18 | – | 31% | 2021-03-18 |
| CVE-2024-27497CheckLinksys E2000 1.0.06 position.js Improper AuthenticationLinksys · E2000 Firmware · CVSS 8.8 · 2024-03-01 | 8.8 | 26% | 2024-03-01 |
| CVE-2024-25852CheckLinksys RE7000 - Command InjectionLinksys · Re7000 Firmware · CVSS 8.8 · 2024-04-11 | 8.8 | 17% | 2024-04-11 |
| CVE-2023-26347CheckAdobe Coldfusion - Authentication BypassAdobe · ColdFusion · CVSS 7.5 · 2023-11-17 | 7.5 | 10% | 2023-11-17 |
| CVE-2021-24215CheckControlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege EscalationWpruby · Controlled Admin Access · 2021-04-12 | – | 8.5% | 2021-04-12 |
| CVE-2015-4050CheckSymfony - Authentication BypassSensiolabs · Symfony · 2015-06-02 | – | 8.2% | 2015-06-02 |
| CVE-2022-36923CheckZoho ManageEngine - getUserAPIKey Authentication BypassZohocorp · Manageengine Opmanager · CVSS 5.4 · 2022-08-10 | 5.4 | 7.7% | 2022-08-10 |
| CVE-2015-1000010CheckWordPress Simple Image Manipulator < 1.0 - Local File InclusionSimple-Image-Manipulator Project · Simple-Image-Manipulator · 2016-10-06 | – | 6.9% | 2016-10-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.