CWE-648 · Access Control
Incorrect Use of Privileged APIs
71CVEs
SortMost likely exploited
71 CVEs with CWE-648 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-76460In CISA KEVExploitedCisco Identity Services Engine - ise-kong API Gateway Authentication BypassCisco · Cisco Identity Services Engine Software · CVSS 10 · 2026-09-16 | 10.0 | 76% | 2026-09-16 |
| CVE-2026-20122In CISA KEVExploitedCisco Catalyst SD-WAN Manager Arbitrary File Overwrite VulnerabilityCisco · Cisco Catalyst SD-WAN Manager · CVSS 5.4 · 2026-02-25 | 5.4 | 26% | 2026-02-25 |
| CVE-2019-14813A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSA…Artifex Software · ghostscript · CVSS 7.3 · 2019-09-06 | 7.3 | 11% | 2019-09-06 |
| CVE-2025-54766KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive InformationXorux · XorMon-NG · CVSS 5.3 · 2025-07-28 | 5.3 | 10% | 2025-07-28 |
| CVE-2025-54765KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to AdministratorXorux · XorMon-NG · CVSS 5.3 · 2025-07-28 | 5.3 | 10% | 2025-07-28 |
| CVE-2024-8785WhatsUp Gold Registry Overwrite Remote Code Execution VulnerabilityProgress Software Corporation · WhatsUp Gold · CVSS 9.8 · 2024-12-02 | 9.8 | 9.7% | 2024-12-02 |
| CVE-2025-54767KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of ServiceXorux · LPAR2RRD · CVSS 6.5 · 2025-07-28 | 6.5 | 8.5% | 2025-07-28 |
| CVE-2025-54768KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive InformationXorux · LPAR2RRD · CVSS 5.3 · 2025-07-28 | 5.3 | 5.9% | 2025-07-28 |
| CVE-2019-1010178Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/…Fred · MODX Revolution · 2019-07-24 | – | 4.6% | 2019-07-24 |
| CVE-2019-14811A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `…Artifex Software · ghostscript · CVSS 7.3 · 2019-09-03 | 7.3 | 3.7% | 2019-09-03 |
| CVE-2022-2023Incorrect Use of Privileged APIs in polonel/trudeskpolonel · polonel/trudesk · CVSS 10 · 2022-06-20 | 10.0 | 3.3% | 2022-06-20 |
| CVE-2019-14869A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass…Ghostscript · ghostscript · CVSS 7.3 · 2019-11-15 | 7.3 | 3.1% | 2019-11-15 |
| CVE-2019-3838It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in or…The ghostscript Project · ghostscript · CVSS 7.3 · 2019-03-25 | 7.3 | 2.5% | 2019-03-25 |
| CVE-2019-3835It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to,…The ghostscript Project · ghostscript · CVSS 7.3 · 2019-03-25 | 7.3 | 2.5% | 2019-03-25 |
| CVE-2019-14812A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-…Red Hat · ghostscript · CVSS 7.3 · 2019-11-27 | 7.3 | 2.5% | 2019-11-27 |
| CVE-2019-10216In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could ab…ghostscript · ghostscript · CVSS 7.3 · 2019-11-27 | 7.3 | 2.3% | 2019-11-27 |
| CVE-2019-14817A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypas…Artifex Software · ghostscript · CVSS 7.3 · 2019-09-03 | 7.3 | 2.0% | 2019-09-03 |
| CVE-2019-3839It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this…The ghostscript Project · ghostscript · CVSS 7.3 · 2019-05-16 | 7.3 | 1.7% | 2019-05-16 |
| CVE-2022-20956A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access syst…Cisco · Cisco Identity Services Engine Software · CVSS 7.1 · 2022-11-03 | 7.1 | 1.5% | 2022-11-03 |
| CVE-2024-11068D-Link DSL6740C - Incorrect Use of Privileged APIsD-Link · DSL6740C · CVSS 9.8 · 2024-11-11 | 9.8 | 1.2% | 2024-11-11 |
| CVE-2020-7927Potential privilege escalation in Ops Manager APIMongoDB Inc. · MongoDB Ops Manager · CVSS 8.1 · 2020-11-23 | 8.1 | 1.0% | 2020-11-23 |
| CVE-2020-5291Privilege escalation in setuid mode via user namespaces in Bubblewrapcontainers · bubblewrap · CVSS 7.2 · 2020-03-31 | 7.2 | 0.9% | 2020-03-31 |
| CVE-2023-29507org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthorsxwiki · xwiki-platform · CVSS 9.1 · 2023-04-16 | 9.1 | 0.9% | 2023-04-16 |
| CVE-2022-4796Incorrect Use of Privileged APIs in usememos/memosusememos · usememos/memos · CVSS 8.1 · 2022-12-28 | 8.1 | 0.8% | 2022-12-28 |
| CVE-2022-24821Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinxxwiki · xwiki-platform · CVSS 6.8 · 2022-04-08 | 6.8 | 0.8% | 2022-04-08 |
| CVE-2023-28062Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit th…Dell · PPDM Reporting (PowerProtect Data Manager) · CVSS 8.8 · 2023-04-11 | 8.8 | 0.8% | 2023-04-11 |
| CVE-2023-4009Privilege Escalation for Project Owner and Project User Admin Roles in Ops ManagerMongoDB Inc. · MongoDB Ops Manager · CVSS 7.2 · 2023-08-08 | 7.2 | 0.8% | 2023-08-08 |
| CVE-2023-4972Information Disclosure in Digital YepasYepas · Digital Yepas · CVSS 9.8 · 2023-09-14 | 9.8 | 0.7% | 2023-09-14 |
| CVE-2022-4687Incorrect Use of Privileged APIs in usememos/memosusememos · usememos/memos · CVSS 8.1 · 2022-12-23 | 8.1 | 0.7% | 2022-12-23 |
| CVE-2022-24071A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.NAVER · NAVER Whale browser · 2022-01-28 | – | 0.7% | 2022-01-28 |
| CVE-2022-20965A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-bas…Cisco · Cisco Identity Services Engine Software · CVSS 4.3 · 2023-01-18 | 4.3 | 0.6% | 2023-01-18 |
| CVE-2025-7344Digiwin｜EAI - Privilege EscalationDigiwin · EAI · CVSS 8.8 · 2025-07-21 | 8.8 | 0.6% | 2025-07-21 |
| CVE-2023-6151Information Disclosure in Eskom E-municipalityESKOM Computer · e-municipality module · CVSS 7.5 · 2023-11-28 | 7.5 | 0.6% | 2023-11-28 |
| CVE-2023-6150Information Disclosure in Eskom E-municipalityESKOM Computer · e-municipality module · CVSS 7.5 · 2023-11-28 | 7.5 | 0.6% | 2023-11-28 |
| CVE-2022-24073The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.NAVER · NAVER Whale browser · 2022-03-17 | – | 0.6% | 2022-03-17 |
| CVE-2022-4805Incorrect Use of Privileged APIs in usememos/memosusememos · usememos/memos · CVSS 7.3 · 2022-12-28 | 7.3 | 0.5% | 2022-12-28 |
| CVE-2024-46978Missing checks for notification filter preferences editions in XWiki Platformxwiki · xwiki-platform · CVSS 6.5 · 2024-09-18 | 6.5 | 0.5% | 2024-09-18 |
| CVE-2023-20136A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should req…Cisco · Cisco Secure Workload · CVSS 4.3 · 2023-06-28 | 4.3 | 0.5% | 2023-06-28 |
| CVE-2026-35639OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope ValidationOpenClaw · OpenClaw · CVSS 8.8 · 2026-04-09 | 8.8 | 0.5% | 2026-04-09 |
| CVE-2023-4993Sensetive Data Exposure in Utarit's SoliclubUtarit Information Technologies · SoliPay Mobile App · CVSS 7.5 · 2024-02-15 | 7.5 | 0.4% | 2024-02-15 |
| CVE-2026-22922Apache Airflow: Airflow externalLogUrl Permission BypassApache Software Foundation · Apache Airflow · CVSS 6.5 · 2026-02-09 | 6.5 | 0.4% | 2026-02-09 |
| CVE-2026-63727Anchore Enterprise Privilege Escalation via User Management APIAnchore · Anchore Enterprise · CVSS 8.8 · 2026-07-28 | 8.8 | 0.4% | 2026-07-28 |
| CVE-2024-37018The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.No vendor recorded · CVSS 9.1 · 2024-05-31 | 9.1 | 0.4% | 2024-05-31 |
| CVE-2025-5997Privilege Escalation in Beamsec PhishProBeamsec · PhishPro · CVSS 8.8 · 2025-07-28 | 8.8 | 0.4% | 2025-07-28 |
| CVE-2025-0589In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two…Octopus Deploy · Octopus Server · CVSS 6.9 · 2025-02-11 | 6.9 | 0.4% | 2025-02-11 |
| CVE-2026-112177Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8Red Hat · Red Hat Enterprise Linux 8 · CVSS 7.3 · 2026-10-20 | 7.3 | 0.4% | 2026-10-20 |
| CVE-2022-26323Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product.OpenText™ · Operations Bridge Manager · CVSS 8.7 · 2025-04-17 | 8.7 | 0.3% | 2025-04-17 |
| CVE-2026-20126Cisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityCisco · Cisco Catalyst SD-WAN Manager · CVSS 8.8 · 2026-02-25 | 8.8 | 0.3% | 2026-02-25 |
| CVE-2026-41386OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup CodesOpenClaw · OpenClaw · CVSS 9.1 · 2026-04-28 | 9.1 | 0.3% | 2026-04-28 |
| CVE-2023-6522Information Disclosure in ExtremePacs's Extreme XDSExtremePacs · Extreme XDS · CVSS 7.2 · 2024-04-05 | 7.2 | 0.3% | 2024-04-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.