CWE-862: Missing authorization
11,498 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 12 of them as exploited in the wild.
- Published CVEs
- 11,498
- Last 12 months
- 5,638
- Critical
- 599
- Known exploited
- 12
Critical 599High 2,820Medium 7,717Low 336Not scored 26
CVEs per yearBy the year they were published
- 2019229
- 20201
- 20203
- 20215
- 2023627
- 20251,578
- 20251,228
- 2025298
- 20254
- 20264,661
- 20262,374
- 2026341
Known exploitedNewest addition to KEV first
- CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9 - CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
kernel
ExploitedHigh7.8 - CVE-2024-57726
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions.…
Product not named
ExploitedCritical9.9 - CVE-2023-52163
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported…
Product not named
ExploitedHigh8.8 - CVE-2025-40602
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
SonicWall · SMA1000
ExploitedMedium6.6 - CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedCritical9.1 - CVE-2025-20362
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases…
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedMedium6.5 - CVE-2021-39226
Snapshot authentication bypass in grafana
grafana · grafana
ExploitedCritical9.8 - CVE-2022-0543
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could…
Debian · redis
ExploitedCritical10.0 - CVE-2021-37976
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from…
Google · Chrome
ExploitedMedium6.5
Newest CVEs
- CVE-2026-116663
Tanium addressed an improper access controls vulnerability in Enforce.
Tanium · Enforce
Medium6.5 - CVE-2026-121169
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…
Google · Chrome
Not scored - CVE-2026-121041
Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121251
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium…
Google · Chrome
Not scored - CVE-2026-121253
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass site isolation via…
Google · Chrome
Not scored - CVE-2026-121101
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…
Google · Chrome
Not scored - CVE-2026-121194
Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain…
Google · Chrome
Not scored - CVE-2026-121116
Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to…
Google · Chrome
Not scored - CVE-2026-121088
Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121075
Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…
Google · Chrome
Not scored