CWE-1220

133 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

Critical 7High 58Medium 56Low 11Not scored 1

CVEs per yearBy the year they were published

CVE-2026-56155
Active Directory Federation Services Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8
CVE-2026-33825
Microsoft Defender Elevation of Privilege Vulnerability
Microsoft · Microsoft Defender Antimalware Platform
ExploitedHigh7.8
CVE-2025-31201
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS…
Apple · iOS and iPadOS
ExploitedCritical9.8

CVE-2026-77779
Improper access control vulnerability
Zohocorp · ManageEngine Key Manager Plus
High7.7
CVE-2026-77778
Improper access control vulnerability
Zohocorp · ManageEngine Key Manager Plus
High7.1
CVE-2026-77777
Improper access control vulnerability
Zohocorp · ManageEngine Key Manager Plus
High7.1
CVE-2026-119627
Gitea limited-visibility profile disclosure with public-only tokens
Gitea · Gitea
Not scored
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
asterisk · asterisk
High8.1
CVE-2026-96372
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Drupal · Webform
Medium5.4
CVE-2026-92539
Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Grafana · Grafana Enterprise
Medium6.7
CVE-2026-85316
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
Apache Software Foundation · Apache Camel
Medium4.8
CVE-2026-111885
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
thorsten · phpMyFAQ
High7.0
CVE-2026-103509
Credential Disclosure in P4 Search Configuration API
Perforce · P4 (Helix core)
High8.5