Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-270

27 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 27 in the listAtom feed of new CVEsWhat CWE-270 is, at MITRE (opens in a new tab)
Published CVEs
27
Last 12 months
6
Critical
5
Known exploited
1

Critical 5High 10Medium 10Low 2Not scored 0

CVEs per yearBy the year they were published

  1. 20181
  2. 20203
  3. 20212
  4. 20233
  5. 20247
  6. 20257
  7. 20264

Known exploitedNewest addition to KEV first

  • CVE-2021-3493

    The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an…

    Ubuntu · linux kernel

    ExploitedHigh8.8

Newest CVEs

  • CVE-2026-88200

    Microsoft Office SharePoint Elevation of Privilege Vulnerability

    Microsoft · Microsoft SharePoint Server Subscription Edition

    High8.8
  • CVE-2026-9560

    Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated…

    OpenVPN Inc · OpenVPN Connect

    Critical9.4
  • CVE-2026-34853

    Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.

    Huawei · HarmonyOS

    High7.7
  • CVE-2025-55210

    FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes

    FreePBX · api

    Low2.0
  • CVE-2025-60721

    Windows Administrator Protection Elevation of Privilege Vulnerability

    Microsoft · Windows 11 Version 24H2

    High7.8
  • CVE-2025-9408

    Userspace privilege escalation vulnerability on Cortex M

    zephyrproject-rtos · Zephyr

    High8.2
  • CVE-2025-26499

    Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a…

    Wind River Studio Developer · Wind River Studio Developer

    Medium6.0
  • CVE-2025-46406

    A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform…

    Gallagher · Command Centre Server

    Medium5.6
  • CVE-2025-49583

    XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

    xwiki · xwiki-platform

    Medium5.1
  • CVE-2025-49581

    XWiki allows remote code execution through default value of wiki macro wiki-type parameters

    xwiki · xwiki-platform

    High8.7

Vendors it comes up for most

  1. xwiki4
  2. Elastic2
  3. GitLab2
  4. Microsoft2
  5. aimeos2
  6. zephyrproject-rtos2
  7. Apache Software Foundation1
  8. DuendeSoftware1
  9. Fortinet1
  10. FreePBX1