CWE-863 · Access Control
Incorrect Authorization
4,226CVEs
20exploited
35with a public check
43likely (EPSS 10%+)
SortMost likely exploited
4,226 CVEs with CWE-863 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-22518In CISA KEVExploitedAtlassian Confluence Server - Improper AuthorizationAtlassian · Confluence Data Center · CVSS 10 · 2023-10-31 | 10.0 | 100% | 2023-10-31 |
| CVE-2023-38035In CISA KEVExploitedIvanti Sentry - Authentication BypassIvanti · MobileIron Sentry · CVSS 9.8 · 2023-08-21 | 9.8 | 100% | 2023-08-21 |
| CVE-2024-38856In CISA KEVExploitedApache OFBiz - Improper Authorization & Remote Code ExecutionApache Software Foundation · Apache OFBiz · CVSS 8.1 · 2024-08-05 | 8.1 | 99% | 2024-08-05 |
| CVE-2026-71362In CISA KEVExploitedAdobe Commerce/Magento - Customer Session Identity SwitchAdobe · Adobe Commerce · CVSS 9.1 · 2026-08-11 | 9.1 | 92% | 2026-08-11 |
| CVE-2019-7192In CISA KEVExploitedQNAP QTS and Photo Station 6.0.3 - Remote Command ExecutionQNAP · QNAP NAS devices running Photo Station · CVSS 9.8 · 2019-12-05 | 9.8 | 88% | 2019-12-05 |
| CVE-2021-40655In CISA KEVExploitedD-Link DIR-605 - Information DisclosureD-Link · DIR-605 Router · CVSS 7.5 · 2021-09-24 | 7.5 | 87% | 2021-09-24 |
| CVE-2018-13382In CISA KEVExploitedAn Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7…Fortinet · Fortinet FortiOS, FortiProxy · CVSS 9.1 · 2019-06-04 | 9.1 | 82% | 2019-06-04 |
| CVE-2025-54253In CISA KEVExploitedAdobe Experience Manager | Incorrect Authorization (CWE-863)Adobe · Adobe Experience Manager · CVSS 10 · 2025-08-05 | 10.0 | 81% | 2025-08-05 |
| CVE-2023-24880In CISA KEVExploitedWindows SmartScreen Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 4.4 · 2023-03-14 | 4.4 | 78% | 2023-03-14 |
| CVE-2021-3560In CISA KEVExploitedIt was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be u…Red Hat · polkit · CVSS 7.8 · 2022-02-16 | 7.8 | 22% | 2022-02-16 |
| CVE-2021-30533In CISA KEVExploitedInsufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.Google · Chrome · CVSS 6.5 · 2021-06-07 | 6.5 | 17% | 2021-06-07 |
| CVE-2025-55177In CISA KEVExploitedIncomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.7…Facebook · WhatsApp Desktop for Mac · CVSS 5.4 · 2025-08-29 | 5.4 | 14% | 2025-08-29 |
| CVE-2023-21715In CISA KEVExploitedMicrosoft Publisher Security Feature Bypass VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 7.3 · 2023-02-14 | 7.3 | 12% | 2023-02-14 |
| CVE-2026-42016In CISA KEVExploitedJFrog Artifactory - Unauthenticated Admin Token Minting via Token Scope Bypassjfrog · artifactory · CVSS 8.1 · 2026-07-27 | 8.1 | 8.6% | 2026-07-27 |
| CVE-2025-24200In CISA KEVExploitedAn authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.…Apple · iOS and iPadOS · CVSS 6.1 · 2025-02-10 | 6.1 | 4.5% | 2025-02-10 |
| CVE-2022-41091In CISA KEVExploitedWindows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 5.4 · 2022-11-09 | 5.4 | 2.3% | 2022-11-09 |
| CVE-2024-21287In CISA KEVExploitedVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is…Oracle Corporation · Oracle Agile PLM Framework · CVSS 7.5 · 2024-11-18 | 7.5 | 1.7% | 2024-11-18 |
| CVE-2025-21479In CISA KEVExploitedIncorrect Authorization in GraphicsQualcomm, Inc. · Snapdragon · CVSS 8.6 · 2025-06-03 | 8.6 | 0.8% | 2025-06-03 |
| CVE-2026-123218In CISA KEVExploitedIBM Aspera Faspex Authorization BypassIBM · Aspera Faspex · CVSS 9.8 · 2026-11-07 | 9.8 | 0.5% | 2026-11-07 |
| CVE-2025-21480In CISA KEVExploitedIncorrect Authorization in Graphics WindowsQualcomm, Inc. · Snapdragon · CVSS 8.6 · 2025-06-03 | 8.6 | 0.4% | 2025-06-03 |
| CVE-2020-36289CheckJira Server and Data Center - Information DisclosureAtlassian · Jira Server · CVSS 5.3 · 2021-05-12 | 5.3 | 99% | 2021-05-12 |
| CVE-2024-6782CheckCalibre <= 7.14.0 Remote Code ExecutionCalibre · Calibre · CVSS 9.8 · 2024-08-06 | 9.8 | 84% | 2024-08-06 |
| CVE-2021-36749CheckApache Druid - Local File InclusionApache Software Foundation · Apache Druid · 2021-09-24 | – | 81% | 2021-09-24 |
| CVE-2021-24917CheckWordPress WPS Hide Login <1.9.1 - Information DisclosureWpserveur · WPS Hide Login · 2021-12-06 | – | 72% | 2021-12-06 |
| CVE-2019-3403CheckJira - Incorrect AuthorizationAtlassian · Jira · 2019-05-22 | – | 54% | 2019-05-22 |
| CVE-2023-26258CheckArcserve UDP <= 9.0.6034 - Authentication BypassArcserve · Udp · 2023-07-03 | – | 40% | 2023-07-03 |
| CVE-2026-35029CheckLiteLLM - Arbitrary File ReadBerriAI · litellm · CVSS 8.8 · 2026-04-06 | 8.8 | 39% | 2026-04-06 |
| CVE-2022-34046CheckWAVLINK WN533A8 - Improper Access ControlWavlink · Wn533a8 Firmware · 2022-07-20 | – | 21% | 2022-07-20 |
| CVE-2019-8446CheckJira Improper AuthorizationAtlassian · Jira · 2019-08-23 | – | 18% | 2019-08-23 |
| CVE-2024-0881CheckCombo Blocks < 2.2.76 - Improper Access ControlPickplugins · Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carou… · CVSS 5.4 · 2024-04-11 | 5.4 | 17% | 2024-04-11 |
| CVE-2021-21389CheckBuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Executionbuddypress · BuddyPress · CVSS 8.1 · 2021-03-26 | 8.1 | 15% | 2021-03-26 |
| CVE-2022-33174CheckPowertek Firmware <3.30.30 - Authorization BypassPowertekpdus · Basic Pdu Firmware · CVSS 9.8 · 2022-06-13 | 9.8 | 14% | 2022-06-13 |
| CVE-2019-3401CheckAtlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect AuthorizationAtlassian · Jira · 2019-05-22 | – | 14% | 2019-05-22 |
| CVE-2021-42192CheckKONGA 0.14.9 - Privilege EscalationKonga Project · Konga · 2022-05-04 | – | 9.8% | 2022-05-04 |
| CVE-2025-49825CheckTeleport - Authentication Bypassgravitational · teleport · CVSS 9.8 · 2025-06-17 | 9.8 | 8.0% | 2025-06-17 |
| CVE-2021-24278CheckWordPress Contact Form 7 <2.3.4 - Arbitrary Nonce GenerationQuery Solutions · Redirection for Contact Form 7 · 2021-05-14 | – | 7.4% | 2021-05-14 |
| CVE-2022-47002CheckMasa CMS - Authentication BypassMasacms · Masacms · 2023-02-01 | – | 6.4% | 2023-02-01 |
| CVE-2023-22620CheckSecurePoint UTM 12.x Session ID LeakSecurepoint · Unified Threat Management · CVSS 7.5 · 2023-04-12 | 7.5 | 3.9% | 2023-04-12 |
| CVE-2026-19598CheckPods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Routersc0ttkclark · Pods – Custom Content Types and Fields · CVSS 9.8 · 2026-08-15 | 9.8 | 3.5% | 2026-08-15 |
| CVE-2021-24947CheckWordPress Responsive Vector Maps < 6.4.2 - Arbitrary File ReadThinkupthemes · RVM – Responsive Vector Maps · 2022-02-07 | – | 3.1% | 2022-02-07 |
| CVE-2023-6421CheckWordPress Download Manager - File Password ExposureW3eden · Download Manager · CVSS 7.5 · 2024-01-01 | 7.5 | 2.4% | 2024-01-01 |
| CVE-2021-37598CheckWP Cerber < 8.9.3 - Broken Access ControlWpcerber · Wp Cerber · 2021-08-19 | – | 2.4% | 2021-08-19 |
| CVE-2022-0594CheckWordPress Shareaholic <9.7.6 - Information DisclosureShareaholic · Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic · 2022-07-25 | – | 2.2% | 2022-07-25 |
| CVE-2024-48651CheckProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sqlNo vendor recorded · CVSS 7.5 · 2024-11-29 | 7.5 | 2.1% | 2024-11-29 |
| CVE-2023-3345CheckLMS by Masteriyo < 1.6.8 - Information ExposureThemegrill · LMS by Masteriyo · 2023-07-31 | – | 2.0% | 2023-07-31 |
| CVE-2026-118267CheckWP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalationpeterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps · CVSS 8.1 · 2026-11-07 | 8.1 | 1.6% | 2026-11-07 |
| CVE-2026-89013CheckDolibarr < 24.0.0 - Authorization Bypass via hashp ParameterDolibarr · Dolibarr · CVSS 7.5 · 2026-09-11 | 7.5 | 1.6% | 2026-09-11 |
| CVE-2026-30965CheckParse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltrationparse-community · parse-server · CVSS 9.9 · 2026-03-10 | 9.9 | 1.5% | 2026-03-10 |
| CVE-2026-26265CheckDiscourse - Private User Field Disclosure via Directory Items IDORdiscourse · discourse · CVSS 7.5 · 2026-02-26 | 7.5 | 1.3% | 2026-02-26 |
| CVE-2024-2473CheckWPS Hide Login <= 1.9.15.2 - Login Page Disclosuretabrisrp · WPS Hide Login · CVSS 5.3 · 2024-06-11 | 5.3 | 1.2% | 2024-06-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.