CWE-424 · Access Control
Improper Protection of Alternate Path
54CVEs
SortMost likely exploited
54 CVEs with CWE-424 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-58136In CISA KEVExploitedYii2 PHP Framework < 2.0.52 - Remote Code Executionyiiframework · Yii · CVSS 9 · 2025-04-10 | 9.0 | 88% | 2025-04-10 |
| CVE-2025-48827CheckvBulletin 5.0.0-6.0.3 - Authentication BypassvBulletin · vBulletin · CVSS 10 · 2025-05-27 | 10.0 | 76% | 2025-05-27 |
| CVE-2025-48828CheckvBulletin replaceAdTemplate - Remote Code ExecutionvBulletin · vBulletin · CVSS 9 · 2025-05-27 | 9.0 | 57% | 2025-05-27 |
| CVE-2019-18997PB610 HMISimulator provides interface with access to arbitrary filesABB · PB610 Panel Builder 600 · CVSS 4.3 · 2019-12-18 | 4.3 | 1.5% | 2019-12-18 |
| CVE-2023-20272A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of…Cisco · Cisco Identity Services Engine Software · CVSS 6.7 · 2023-11-21 | 6.7 | 0.9% | 2023-11-21 |
| CVE-2026-113756Windows FileCrypt Driver Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 5.3 · 2026-11-10 | 5.3 | 0.8% | 2026-11-10 |
| CVE-2026-66756Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseApache Software Foundation · Apache Tika · CVSS 6.9 · 2026-07-30 | 6.9 | 0.7% | 2026-07-30 |
| CVE-2021-3793An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the dev…Motorola · Binatone Hubble Cameras · CVSS 6.5 · 2021-11-12 | 6.5 | 0.7% | 2021-11-12 |
| CVE-2026-82754ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsash-project · ash_authentication_oauth2_server · CVSS 6.3 · 2026-09-07 | 6.3 | 0.7% | 2026-09-07 |
| CVE-2026-114659Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesgetgrav · grav-plugin-flex-objects · CVSS 6.5 · 2026-10-22 | 6.5 | 0.6% | 2026-10-22 |
| CVE-2024-8311Improper Protection of Alternate Path in GitLabGitLab · GitLab · CVSS 6.5 · 2024-09-12 | 6.5 | 0.6% | 2024-09-12 |
| CVE-2026-4913Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.Ivanti · Neurons for ITSM (On-Premise) · CVSS 5.7 · 2026-04-14 | 5.7 | 0.6% | 2026-04-14 |
| CVE-2026-82586AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesash-project · ash_lua · CVSS 8.2 · 2026-09-07 | 8.2 | 0.5% | 2026-09-07 |
| CVE-2026-116316PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session findPostgreSQL · CVSS 8.8 · 2026-11-12 | 8.8 | 0.5% | 2026-11-12 |
| CVE-2026-113757Windows FileCrypt Driver Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 5.5 · 2026-11-10 | 5.5 | 0.5% | 2026-11-10 |
| CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)Gitea · Gitea Open Source Git Server · CVSS 6.5 · 2026-08-13 | 6.5 | 0.5% | 2026-08-13 |
| CVE-2026-86145PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a…PCRE · PCRE2 · CVSS 8.2 · 2026-09-05 | 8.2 | 0.4% | 2026-09-05 |
| CVE-2024-3927Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypassbdthemes · Element Pack – Widgets, Templates & Addons for Elementor · CVSS 5.3 · 2024-05-22 | 5.3 | 0.4% | 2024-05-22 |
| CVE-2026-112809Windows Composite Image File System Information Disclosure VulnerabilityMicrosoft · Windows 11 version 26H1 · CVSS 5.5 · 2026-11-10 | 5.5 | 0.4% | 2026-11-10 |
| CVE-2026-112803Windows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 5.5 · 2026-11-10 | 5.5 | 0.4% | 2026-11-10 |
| CVE-2019-18996ABB PB610 HMIStudio accepts malicious DLL file in an applicationABB · PB610 Panel Builder 600 · CVSS 7.1 · 2019-12-18 | 7.1 | 0.4% | 2019-12-18 |
| CVE-2026-76529Improper Protection of Alternate Path in Splunk SOARSplunk · Splunk SOAR · CVSS 9.8 · 2026-10-21 | 9.8 | 0.4% | 2026-10-21 |
| CVE-2026-69979Windows AppX Deployment Service Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 21H2 · CVSS 5.5 · 2026-10-13 | 5.5 | 0.4% | 2026-10-13 |
| CVE-2025-68939Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.Gitea · Gitea · CVSS 8.2 · 2025-12-26 | 8.2 | 0.3% | 2025-12-26 |
| CVE-2023-5165Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shellDocker Inc. · Docker Desktop · CVSS 7.1 · 2023-09-25 | 7.1 | 0.3% | 2023-09-25 |
| CVE-2026-54423In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI…OpenStack · Ironic · CVSS 8.2 · 2026-07-10 | 8.2 | 0.3% | 2026-07-10 |
| CVE-2025-58079Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.NEOJAPAN Inc. · desknet's NEO · CVSS 5.3 · 2025-10-16 | 5.3 | 0.3% | 2025-10-16 |
| CVE-2026-120154PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policiesPostgreSQL · CVSS 4.3 · 2026-11-12 | 4.3 | 0.3% | 2026-11-12 |
| CVE-2026-89419OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintena…OpenStack · Ironic · CVSS 5 · 2026-10-23 | 5.0 | 0.3% | 2026-10-23 |
| CVE-2022-17422.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424Dominion Voting Systems · ImageCast X application · CVSS 6.8 · 2022-06-24 | 6.8 | 0.3% | 2022-06-24 |
| CVE-2026-14242Authorization bypass in the Git Sync provisioning jobs APIGrafana · Grafana OSS · CVSS 6.5 · 2026-11-11 | 6.5 | 0.3% | 2026-11-11 |
| CVE-2024-3460In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced a…Kioware · Kioware · CVSS 7.4 · 2024-05-09 | 7.4 | 0.3% | 2024-05-09 |
| CVE-2026-16237PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE conditionPostgreSQL · CVSS 5.4 · 2026-11-12 | 5.4 | 0.3% | 2026-11-12 |
| CVE-2024-3459KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using bui…Kioware · Kioware · CVSS 8.4 · 2024-05-09 | 8.4 | 0.3% | 2024-05-09 |
| CVE-2025-0113Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker ContainersPalo Alto Networks · Cortex XDR Broker VM · CVSS 5.3 · 2025-02-12 | 5.3 | 0.3% | 2025-02-12 |
| CVE-2025-46654CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uplo…HackMD · CodiMD · CVSS 4.9 · 2025-04-26 | 4.9 | 0.3% | 2025-04-26 |
| CVE-2025-46655CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-or…HackMD · CodiMD · CVSS 4.9 · 2025-04-26 | 4.9 | 0.3% | 2025-04-26 |
| CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance · wasmtime · CVSS 3.7 · 2026-11-03 | 3.7 | 0.2% | 2026-11-03 |
| CVE-2023-0629Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containersDocker Inc. · Docker Desktop · CVSS 7.1 · 2023-03-13 | 7.1 | 0.2% | 2023-03-13 |
| CVE-2026-107352Missing authorization checks in Amazon Athena engine version 3 request handlingAWS · Amazon Athena · CVSS 7.7 · 2026-10-07 | 7.7 | 0.2% | 2026-10-07 |
| CVE-2025-49162Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local fil…Arris · VIP1113 · CVSS 6.4 · 2025-06-02 | 6.4 | 0.2% | 2025-06-02 |
| CVE-2023-46176IBM MQ privilege escalationIBM · MQ Appliance · CVSS 6.7 · 2023-11-03 | 6.7 | 0.2% | 2023-11-03 |
| CVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presetsrenovatebot · renovate · CVSS 7.1 · 2026-10-14 | 7.1 | 0.2% | 2026-10-14 |
| CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallDocker · Docker Desktop · CVSS 9.2 · 2026-11-03 | 9.2 | 0.2% | 2026-11-03 |
| CVE-2025-6250Privilege Management for Windows - Elevation of PrivilegeBeyondTrust · Privilege Management for Windows · CVSS 7.1 · 2025-07-28 | 7.1 | 0.2% | 2025-07-28 |
| CVE-2023-52952A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435) (All versions >= V11…Siemens · HiMed Cockpit 12 pro · CVSS 8.5 · 2024-10-08 | 8.5 | 0.2% | 2024-10-08 |
| CVE-2026-37008CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of mod…CrewAI · CrewAI · CVSS 8.1 · 2026-09-13 | 8.1 | 0.2% | 2026-09-13 |
| CVE-2025-49163Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.Arris · VIP1113 · CVSS 6.7 · 2025-06-02 | 6.7 | 0.2% | 2025-06-02 |
| CVE-2026-4270AWS API MCP File Access Restriction BypassAWS · AWS API MCP Server · CVSS 5.5 · 2026-03-16 | 5.5 | 0.2% | 2026-03-16 |
| CVE-2026-0237Prisma Browser: Improperly Restricted Automation Bridge Allows Security BypassPalo Alto Networks · Prisma Browser · CVSS 7.3 · 2026-05-13 | 7.3 | 0.1% | 2026-05-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.