CWE-250

CVEs per yearBy the year they were published

1. 20187
2. 201910
3. 20208
4. 202117
5. 202225
6. 202327
7. 202467
8. 2025105
9. 2026133

Known exploitedNewest addition to KEV first

• CVE-2025-40602

  A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

  SonicWall · SMA1000

  ExploitedMedium6.6
• CVE-2024-38813

  Privilege escalation vulnerability

  VMware vCenter Server

  ExploitedHigh7.5

Newest CVEs

• CVE-2025-55002

  JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses

  jupyterlab · jupyterlab-desktop

  Medium5.5
• CVE-2025-54991

  JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)

  jupyterlab · jupyterlab-desktop

  Medium5.5
• CVE-2026-95652

  Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter

  TÜBİTAK BİLGEM Software Technologies Research Institute · pardus-usb-formatter

  Medium6.6
• CVE-2026-121234

  Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…

  Google · Chrome

  Critical9.6
• CVE-2026-121196

  Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a…

  Google · Chrome

  Not scored
• CVE-2026-94290

  Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

  SUSE · Rancher

  Critical9.1
• CVE-2026-40573

  NovumOS: Nova Interpreter Privilege Escalation

  MinecAnton209 · NovumOS

  High8.6
• CVE-2025-30046

  Remote Code Execution in CGM CLININET

  CGM · CGM CLININET

  Critical9.0
• CVE-2026-91335

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions…

  Oracle Corporation · Oracle Java SE

  Low2.6
• CVE-2026-113342

  Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via…

  Google · Chrome

  Critical9.6

Vendors it comes up for most

1. IBM36
2. Dell19
3. Red Hat16
4. Google14
5. Cisco12
6. Siemens9
7. Iocharger8
8. NVIDIA8
9. Microsoft7
10. F56