Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-277

70 published CVEs are weaknesses of this kind, as the records or NVD name it.

All 70 in the listAtom feed of new CVEsWhat CWE-277 is, at MITRE (opens in a new tab)
Published CVEs
70
Last 12 months
9
Critical
3
Known exploited
0

Critical 3High 20Medium 44Low 3Not scored 0

CVEs per yearBy the year they were published

  1. 20191
  2. 20201
  3. 20214
  4. 20221
  5. 202314
  6. 202425
  7. 202518
  8. 20266

Newest CVEs

  • CVE-2025-11395

    Podman: arbitrary file write when importing oci archive

    Red Hat · Red Hat Enterprise Linux 10

    Medium5.5
  • CVE-2026-9046

    A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the…

    Lenovo · Legion Zone

    High7.3
  • CVE-2026-30266

    Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file

    Product not named

    High7.8
  • CVE-2026-20630

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may…

    Apple · macOS

    Medium5.5
  • CVE-2025-32092

    Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow an escalation of…

    Intel(R) Graphics Software

    Medium5.4
  • CVE-2025-37174

    Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface

    Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)

    High7.2
  • CVE-2025-65111

    SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

    authzed · spicedb

    Low2.9
  • CVE-2025-64185

    Open OnDemand RPM packages create world writable locations

    OSC · ondemand

    Medium6.9
  • CVE-2025-24327

    Insecure inherited permissions for some Intel(R) Rapid Storage Technology Application before version 20.0.1021 within Ring 3: User Applications may allow an…

    Intel(R) Rapid Storage Technology Application

    Medium5.4
  • CVE-2025-11554

    Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

    Portabilis · i-Educar

    Medium5.3

Vendors it comes up for most

  1. Apple7
  2. IBM3
  3. Dell2
  4. Facebook2
  5. Red Hat2
  6. SAP_SE2
  7. Amazon1
  8. Apache Software Foundation1
  9. Becton, Dickinson and Company (BD)1
  10. Hewlett Packard Enterprise (HPE)1