Skip to content
CVE Tracker

CWE-266

1,277 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 1,277 in the listAtom feed of new CVEsWhat CWE-266 is, at MITRE (opens in a new tab)
Published CVEs
1,277
Last 12 months
692
Critical
157
Known exploited
1

Critical 157High 343Medium 735Low 41Not scored 1

CVEs per yearBy the year they were published

  1. 20141
  2. 20182
  3. 202118
  4. 202432
  5. 2025154
  6. 202517
  7. 20253
  8. 20252
  9. 2026595
  10. 2026410
  11. 202630
  12. 202612

Known exploitedNewest addition to KEV first

  • CVE-2026-48172

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…

    LiteSpeed Technologies · cPanel Plugin

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-121539

    miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control

    miroslavpejic85 · MiroTalk P2P

    Medium5.3
  • CVE-2026-121514

    EasySoft ZenTao PMS User model.php checkGroupChange privileges management

    EasySoft · ZenTao PMS

    Medium5.3
  • CVE-2026-119922

    Babelfish for PostgreSQL Privilege Escalation

    AWS · babelfish-for-postgresql

    High8.7
  • CVE-2026-120224

    Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

    Oray · Pugongying X5 Pro

    Critical9.4
  • CVE-2026-120185

    ken678 YznCMS Auth Group Group.php Backend privileges management

    ken678 · YznCMS

    Medium5.1
  • CVE-2026-118086

    WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

    Hakan Ozevin · WP BASE Booking

    High8.8
  • CVE-2026-116386

    WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability

    Cozy Vision Technologies Pvt. Ltd. · SMS Alert Order Notifications

    Critical9.8
  • CVE-2026-54854

    WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

    Cozmoslabs · Profile Builder

    Medium6.3
  • CVE-2026-119599

    AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes

    looplj · AxonHub

    Medium5.3
  • CVE-2026-118082

    WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

    BuddyBoss · Buddyboss Platform

    High8.8

Vendors it comes up for most

  1. SourceCodester47
  2. Red Hat33
  3. D-Link30
  4. Cisco18
  5. Totolink18
  6. Dell16
  7. Portabilis16
  8. IBM13
  9. code-projects13
  10. yeqifu13