CWE-862 · Access Control
Missing Authorization
11,120CVEs
11exploited
123with a public check
27likely (EPSS 10%+)
SortMost likely exploited
11,120 CVEs with CWE-862 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-0543In CISA KEVExploitedRedis Sandbox Escape - Remote Code ExecutionDebian · redis · CVSS 10 · 2022-02-18 | 10.0 | 99% | 2022-02-18 |
| CVE-2023-52163In CISA KEVExploitedDigiever DS-2105 Pro - Command InjectionDigiever · DS-2105 Pro · CVSS 8.8 · 2025-02-03 | 8.8 | 97% | 2025-02-03 |
| CVE-2025-20362In CISA KEVExploitedCisco Secure Firewall ASA & FTD - Authentication BypassCisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · CVSS 6.5 · 2025-09-25 | 6.5 | 87% | 2025-09-25 |
| CVE-2021-30657In CISA KEVExploitedA logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gateke…Apple · macOS · CVSS 5.5 · 2021-09-08 | 5.5 | 69% | 2021-09-08 |
| CVE-2025-6205In CISA KEVExploitedDELMIA Apriso - Broken Access ControlDassault Systèmes · DELMIA Apriso · CVSS 9.1 · 2025-08-04 | 9.1 | 67% | 2025-08-04 |
| CVE-2024-57726In CISA KEVExploitedSimpleHelp <= 5.5.7 - Privilege EscalationSimpleHelp · SimpleHelp · CVSS 9.9 · 2025-01-15 | 9.9 | 66% | 2025-01-15 |
| CVE-2021-37976In CISA KEVExploitedInappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a craft…Google · Chrome · CVSS 6.5 · 2021-10-08 | 6.5 | 20% | 2021-10-08 |
| CVE-2021-30713In CISA KEVExploitedA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is…Apple · macOS · CVSS 7.8 · 2021-09-08 | 7.8 | 7.0% | 2021-09-08 |
| CVE-2025-40602In CISA KEVExploitedA local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).SonicWall · SMA1000 · CVSS 6.6 · 2025-12-18 | 6.6 | 2.8% | 2025-12-18 |
| CVE-2026-123039In CISA KEVExploitedLocal privilege escalation to root in the DynamicCLI daemon via local world-writable control socketcheckpoint · Quantum Security Gateway · CVSS 7.8 · 2026-11-12 | 7.8 | 2.2% | 2026-11-12 |
| CVE-2026-84869In CISA KEVExploitedScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsConnectWise · ScreenConnect · CVSS 9.9 · 2026-09-08 | 9.9 | 1.2% | 2026-09-08 |
| CVE-2021-21978CheckVMware View Planner <4.6 SP1- Remote Code ExecutionVmware · VMware View Planner · 2021-03-03 | – | 99% | 2021-03-03 |
| CVE-2022-1329CheckElementor Website Builder - Remote Code Executionelemntor · Elementor Website Builder · CVSS 8.8 · 2022-04-19 | 8.8 | 93% | 2022-04-19 |
| CVE-2021-21307CheckLucee Admin - Remote Code Executionlucee · Lucee · CVSS 8.6 · 2021-02-11 | 8.6 | 89% | 2021-02-11 |
| CVE-2020-8772CheckWordPress InfiniteWP <1.9.4.5 - Authorization BypassRevmakx · Infinitewp Client · 2020-02-06 | – | 88% | 2020-02-06 |
| CVE-2023-26035CheckZoneMinder Snapshots - Command InjectionZoneMinder · zoneminder · CVSS 7.2 · 2023-02-25 | 7.2 | 80% | 2023-02-25 |
| CVE-2022-23944CheckApache ShenYu Admin Unauth AccessApache Software Foundation · Apache ShenYu (incubating) · 2022-01-25 | – | 79% | 2022-01-25 |
| CVE-2019-19985CheckWordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File RetrievalIcegram · Email Subscribers & Newsletters · CVSS 5.8 · 2019-12-26 | 5.8 | 71% | 2019-12-26 |
| CVE-2021-45467CheckControl Web Panel (CWP) - File InclusionControl-Webpanel · Webpanel · CVSS 9.8 · 2022-12-26 | 9.8 | 71% | 2022-12-26 |
| CVE-2018-10093CheckAudioCodes 420HD - Remote Code ExecutionAudiocodes · 420hd Ip Phone Firmware · 2019-03-17 | – | 68% | 2019-03-17 |
| CVE-2021-32172CheckMaian Cart <=3.8 - Remote Code ExecutionMaianscriptworld · Maian Cart · 2021-10-07 | – | 66% | 2021-10-07 |
| CVE-2022-0218CheckHTML Email Template Designer < 3.1 - Missing Authorization on Rest Routecodemiq · WP HTML Mail · CVSS 8.3 · 2022-02-04 | 8.3 | 66% | 2022-02-04 |
| CVE-2025-11833CheckPost SMTP <= 3.6.0 - Email Log Disclosuresaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Al… · CVSS 9.8 · 2025-11-01 | 9.8 | 61% | 2025-11-01 |
| CVE-2024-11972CheckHunk Companion < 1.9.0 - Unauthenticated Plugin InstallationThemehunk · Hunk Companion · CVSS 9.8 · 2024-12-31 | 9.8 | 59% | 2024-12-31 |
| CVE-2025-5394CheckUnauthenticated Arbitrary Plugin Upload in Alone ThemeBearsthemes · Alone – Charity Multipurpose Non-profit WordPress Theme · CVSS 9.8 · 2025-07-15 | 9.8 | 53% | 2025-07-15 |
| CVE-2023-25573CheckMetersphere - Arbitrary File Readmetersphere · metersphere · CVSS 8.6 · 2023-03-09 | 8.6 | 52% | 2023-03-09 |
| CVE-2018-1217CheckDell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access ControlDell EMC · Avamar, Integrated Data Protection Appliance · 2018-04-09 | – | 51% | 2018-04-09 |
| CVE-2024-1380CheckRelevanssi (A Better Search) <= 4.22.0 - Query Log ExportRelevanssi · Relevanssi Premium · CVSS 5.3 · 2024-03-13 | 5.3 | 50% | 2024-03-13 |
| CVE-2021-21246CheckOneDev < 4.0.3 - User Access Token Leaktheonedev · onedev · CVSS 8.6 · 2021-01-15 | 8.6 | 49% | 2021-01-15 |
| CVE-2024-43919CheckYARPP <= 5.30.10 - Missing AuthorizationYARPP · YARPP · CVSS 5.3 · 2024-11-01 | 5.3 | 45% | 2024-11-01 |
| CVE-2023-2796CheckEventON <= 2.1 - Missing AuthorizationMyeventon · EventON · 2023-07-10 | – | 43% | 2023-07-10 |
| CVE-2024-3097CheckNextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosuresmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 5.3 · 2024-04-09 | 5.3 | 38% | 2024-04-09 |
| CVE-2024-0235CheckEventON (Free < 2.2.8, Premium < 4.5.5) - Information DisclosureMyeventon · EventON · CVSS 5.3 · 2024-01-16 | 5.3 | 38% | 2024-01-16 |
| CVE-2023-0678CheckPHPIPAM <v1.5.1 - Missing Authorizationphpipam · phpipam/phpipam · CVSS 7.5 · 2023-02-04 | 7.5 | 37% | 2023-02-04 |
| CVE-2023-36144CheckIntelbras Switch - Information DisclosureIntelbras · Sg 2404 Mr Firmware · 2023-06-30 | – | 37% | 2023-06-30 |
| CVE-2024-6366CheckUser Profile Builder < 3.11.8 - File UploadCozmoslabs · User Profile Builder · CVSS 9.1 · 2024-07-29 | 9.1 | 29% | 2024-07-29 |
| CVE-2022-1020CheckWordPress WooCommerce <3.1.2 - Arbitrary Function CallCodeastrology · Product Table for WooCommerce (wooproducttable) · 2022-04-18 | – | 26% | 2022-04-18 |
| CVE-2022-39960CheckJira Netic Group Export <1.0.3 - Missing AuthorizationNetic · Group Export · 2022-09-17 | – | 26% | 2022-09-17 |
| CVE-2026-25939CheckFUXA - Authorization Bypassfrangoteam · FUXA · CVSS 9.3 · 2026-02-09 | 9.3 | 24% | 2026-02-09 |
| CVE-2019-16097CheckHarbor <=1.82.0 - Privilege EscalationLinuxfoundation · Harbor · 2019-09-08 | – | 22% | 2019-09-08 |
| CVE-2021-4374CheckWordPress Automatic Plugin - Unauthenticated Options ChangeValvePress · WordPress Automatic Plugin · CVSS 9.1 · 2023-06-07 | 9.1 | 16% | 2023-06-07 |
| CVE-2023-6020CheckRay Static File - Local File Inclusionray-project · ray-project/ray · CVSS 7.5 · 2023-11-16 | 7.5 | 15% | 2023-11-16 |
| CVE-2022-36642CheckOmnia MPX 1.5.0+r1 - Local File InclusionTelosalliance · Omnia Mpx Node Firmware · 2022-09-02 | – | 13% | 2022-09-02 |
| CVE-2022-2552CheckDuplicator < 1.4.7.1 - Information DisclosureAwesomemotive · Duplicator · 2022-08-22 | – | 12% | 2022-08-22 |
| CVE-2022-1574CheckWordPress HTML2WP <=1.0.0 - Arbitrary File UploadHtml2wp Project · HTML2WP · 2022-06-27 | – | 12% | 2022-06-27 |
| CVE-2022-0952CheckWordPress Sitemap by click5 <1.0.36 - Missing AuthorizationSitemap Project · Sitemap by click5 · 2022-05-02 | – | 11% | 2022-05-02 |
| CVE-2020-11514CheckRank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API EndpointRankmath · Seo · 2020-04-07 | – | 11% | 2020-04-07 |
| CVE-2024-9234CheckGutenKit <= 2.1.0 - Arbitrary File Uploadataurr · GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Edi… · CVSS 9.8 · 2024-10-11 | 9.8 | 10% | 2024-10-11 |
| CVE-2022-0885CheckMember Hero <=1.0.9 - Remote Code ExecutionMemberhero · Member Hero · 2022-06-13 | – | 9.4% | 2022-06-13 |
| CVE-2024-9707CheckHunk Companion <= 1.8.4 - Arbitrary Plugin Installationthemehunk · Hunk Companion · CVSS 9.8 · 2024-10-11 | 9.8 | 9.1% | 2024-10-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.