Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-266

1,294 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 1,294 in the listAtom feed of new CVEsWhat CWE-266 is, at MITRE (opens in a new tab)
Published CVEs
1,294
Last 12 months
704
Critical
161
Known exploited
1

Critical 161High 345Medium 744Low 42Not scored 2

CVEs per yearBy the year they were published

  1. 20131
  2. 20141
  3. 20171
  4. 20184
  5. 20194
  6. 202019
  7. 202119
  8. 202228
  9. 202323
  10. 2024124
  11. 2025426
  12. 2026644

Known exploitedNewest addition to KEV first

  • CVE-2026-48172

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via…

    LiteSpeed Technologies · cPanel Plugin

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-3684

    Vulnerabilities exists in IBM Cloud Pak for Data System

    IBM · Cloud Pak for Data System

    Medium6.5
  • CVE-2026-109900

    WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability

    Melapress · Melapress Role Editor

    Critical9.6
  • CVE-2026-124429

    Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration

    craftcms · cms

    High8.7
  • CVE-2026-123989

    ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission

    ESEngine · DeepSeek-Reasonix

    Medium5.3
  • CVE-2026-123881

    OpenBMB Internet of Agents Message app.py fetch_chat_record access control

    OpenBMB · Internet of Agents

    Medium6.9
  • CVE-2026-123676

    xxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization

    xxyopen · novel

    Medium6.9
  • CVE-2026-123665

    kubescape Output printresults.go GetWriter permission

    kubescape

    Low2.4
  • CVE-2026-123664

    nasa-gcn gcn.nasa.gov Email Notification email improper authorization

    nasa-gcn · gcn.nasa.gov

    Medium5.3
  • CVE-2026-120844

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

    miniOrange · OAuth Single Sign On – SSO (OAuth Client)

    Critical9.8
  • CVE-2026-9797

    Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator

    Red Hat · Red Hat Build of Keycloak

    Medium6.5

Vendors it comes up for most

  1. SourceCodester47
  2. Red Hat34
  3. D-Link30
  4. Cisco18
  5. TOTOLINK18
  6. Dell16
  7. Portabilis16
  8. IBM14
  9. code-projects13
  10. yeqifu13