CWE-284: Improper access control
8,795 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 36 of them as exploited in the wild.
- Published CVEs
- 8,795
- Last 12 months
- 4,705
- Critical
- 1,115
- Known exploited
- 36
Critical 1,115High 3,436Medium 3,880Low 360Not scored 4
CVEs per yearBy the year they were published
- 20192
- 202378
- 202372
- 2024387
- 2024207
- 20264,410
- 20261,216
- 2026748
- 2026531
- 2026130
- 202642
- 202614
Known exploitedNewest addition to KEV first
- CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product not named
ExploitedCritical10.0 - CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 23H2
ExploitedHigh7.8 - CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…
Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
ExploitedCritical10.0 - CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla
ExploitedCritical10.0 - CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…
Fortinet · FortiClientEMS
ExploitedCritical9.1 - CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
vitejs · vite
ExploitedMedium5.3 - CVE-2025-12480
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is…
TrioFox · TrioFox
ExploitedCritical9.1 - CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh8.8 - CVE-2025-59230
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
Newest CVEs
- CVE-2026-121539
miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control
miroslavpejic85 · MiroTalk P2P
Medium5.3 - CVE-2026-121509
Headless CMS Plugin REST API post get_required_post_data information disclosure
Headless CMS Plugin
Medium6.9 - CVE-2026-121416
SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
surrealdb · surrealdb
High7.1 - CVE-2026-16900
Authentication Bypass
Zohocorp · Log360
High7.5 - CVE-2026-13594
Improper Access Control vulnerability
Zohocorp · Log360
Critical9.1 - CVE-2026-120503
EchoHS GeekezBrowser Public API status information disclosure
EchoHS · GeekezBrowser
Medium4.8 - CVE-2026-28588
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could…
Google · Android
High8.4 - CVE-2026-0053
In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android…
Google · Android
High8.4 - CVE-2026-115654
User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
Eclipse Foundation · Eclipse ThreadX
Medium6.9 - CVE-2026-120323
samanhappy MCPHub passthroughHeaders.ts information disclosure
samanhappy · MCPHub
Medium5.3