CWE-269: Improper privilege management
3,904 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 22 of them as exploited in the wild.
- Published CVEs
- 3,904
- Last 12 months
- 1,475
- Critical
- 498
- Known exploited
- 22
Critical 498High 2,400Medium 922Low 82Not scored 2
CVEs per yearBy the year they were published
- 20158
- 201611
- 201797
- 2018119
- 2019164
- 2020276
- 2021343
- 2022308
- 2023355
- 2024419
- 2025348
- 20261,419
Known exploitedNewest addition to KEV first
- CVE-2026-102490
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
Zammad GmbH · Zammad
ExploitedHigh8.5 - CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9 - CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are…
Oracle Corporation · Oracle Payments
ExploitedCritical9.8 - CVE-2026-21533
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8 - CVE-2024-8068
Privilege escalation to NetworkService Account access
Citrix · Citrix Session Recording
ExploitedMedium5.1 - CVE-2024-49035
Partner.Microsoft.Com Elevation of Privilege Vulnerability
Microsoft · Microsoft Partner Center
ExploitedHigh8.7 - CVE-2013-0643
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before…
Product not named
ExploitedHigh8.8 - CVE-2024-38014
Windows Installer Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2024-26169
Windows Error Reporting Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
minio · minio
ExploitedHigh8.8
Newest CVEs
- CVE-2026-123549
OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
OpenIdentityPlatform · OpenAM
Critical9.3 - CVE-2026-123520
Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
go-vikunja · vikunja
High7.1 - CVE-2026-119075
Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout
themegrill · Registration Form for WooCommerce
Critical9.8 - CVE-2026-104768
AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option
rubengc · AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
High7.5 - CVE-2026-119164
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
tomdever · wpForo Forum
High7.5 - CVE-2026-103900
WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter
denishua · WPJAM Basic
High8.1 - CVE-2026-83495
Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration
Red Hat · Red Hat OpenShift AI (RHOAI)
Not scored - CVE-2026-121866
Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update
Unknown · iLeads SMS Gateway by Exsile
High8.8 - CVE-2026-121848
Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation
Unknown · Magic Link
High8.8 - CVE-2026-103985
FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
freescout-help-desk · freescout
High7.1