CWE-276: Incorrect default permissions
1,591 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 1,591
- Last 12 months
- 199
- Critical
- 132
- Known exploited
- 3
Critical 132High 759Medium 633Low 67Not scored 0
CVEs per yearBy the year they were published
- 20151
- 20163
- 201725
- 201824
- 201989
- 2020203
- 2021155
- 2022202
- 2023190
- 2024279
- 2025233
- 2026169
Known exploitedNewest addition to KEV first
- CVE-2026-87886
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build…
Acronis · Acronis Backup plugin for cPanel & WHM
ExploitedHigh7.8 - CVE-2022-22948
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to…
VMware vCenter Server and VMware Cloud Foundation
ExploitedMedium6.5 - CVE-2013-0632
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging…
Product not named
ExploitedCritical9.8
Newest CVEs
- CVE-2026-123505
Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
go-vikunja · vikunja
Medium6.8 - CVE-2026-123500
Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
go-vikunja · vikunja
Medium6.9 - CVE-2026-44875
In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows elevated access by a…
Hewlett Packard Enterprise (HPE) · HPE Cray Programming Environment
High7.8 - CVE-2026-94460
IRISPowerscan Insecure default privilege assignment for installation account
I.R.I.S S.A. · IRISPowerscan
High7.2 - CVE-2026-16305
CVE-2026-16305
INFINITT Healthcare · System Manager
High7.8 - CVE-2026-91895
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local…
Dell · Alienware Command Center (AWCC)
High7.1 - CVE-2026-114148
ASP.NET Core Elevation of Privilege Vulnerability
Microsoft · .NET 10.0 installed on Linux
High7.8 - CVE-2026-107052
Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside…
Product not named
High7.5 - CVE-2026-112357
GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation
GFI USA, LLC · GFI KerioConnect
High8.5 - CVE-2026-113345
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access…
Ministry of Land, Infrastructure, Transport and Tourism, Japan · Electronic delivery item Inspection Support System
High8.5