CWE-863: Incorrect authorization
4,799 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 22 of them as exploited in the wild.
- Published CVEs
- 4,799
- Last 12 months
- 2,464
- Critical
- 439
- Known exploited
- 22
Critical 439High 1,674Medium 2,314Low 308Not scored 64
CVEs per yearBy the year they were published
- 20195
- 20193
- 202266
- 2023286
- 2023300
- 20233
- 2024420
- 2025441
- 20262,300
- 2026503
- 2026215
- 202614
Known exploitedNewest addition to KEV first
- CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe · Adobe Commerce
ExploitedCritical9.1 - CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
jfrog · artifactory
ExploitedHigh8.1 - CVE-2025-54253
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe · Adobe Experience Manager
ExploitedCritical10.0 - CVE-2025-55177
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…
Facebook · WhatsApp Desktop for Mac
ExploitedMedium5.4 - CVE-2025-21479
Incorrect Authorization in Graphics
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-21480
Incorrect Authorization in Graphics Windows
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-24200
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS…
Apple · iOS and iPadOS
ExploitedMedium6.1 - CVE-2024-21287
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version…
Oracle Corporation · Oracle Agile PLM Framework
ExploitedHigh7.5 - CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache Software Foundation · Apache OFBiz
ExploitedHigh8.1 - CVE-2021-40655
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request…
Product not named
ExploitedHigh7.5
Newest CVEs
- CVE-2026-92191
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability
Quest · Foglight for Databases
High8.8 - CVE-2026-116661
Tanium addressed an improper access controls vulnerability in Enforce.
Tanium · Enforce
Medium6.5 - CVE-2026-116667
Tanium addressed an improper access controls vulnerability in Discover.
Tanium · Discover
Medium4.2 - CVE-2026-116664
Tanium addressed an improper access controls vulnerability in Discover.
Tanium · Discover
Low3.1 - CVE-2026-121541
Bake filesystem path entitlements approval can be skipped in some multi-target builds
Docker · Docker Buildx
Medium5.6 - CVE-2026-120930
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121195
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121142
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…
Google · Chrome
Not scored - CVE-2026-121232
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information…
Google · Chrome
Not scored - CVE-2026-121029
Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium…
Google · Chrome
Not scored