CWE-284: Improper access control
8,873 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 36 of them as exploited in the wild.
- Published CVEs
- 8,873
- Last 12 months
- 4,771
- Critical
- 1,121
- Known exploited
- 36
Critical 1,121High 3,469Medium 3,916Low 363Not scored 4
CVEs per yearBy the year they were published
- 2015144
- 2016399
- 2017278
- 201894
- 2019166
- 2020113
- 2021156
- 2022362
- 2023487
- 2024781
- 20251,253
- 20264,598
Known exploitedNewest addition to KEV first
- CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Product not named
ExploitedCritical10.0 - CVE-2026-81963
Windows Update Stack Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 23H2
ExploitedHigh7.8 - CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…
Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
ExploitedCritical10.0 - CVE-2026-34908
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to…
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
joomlacontenteditor.net · Joomla Content Editor (JCE) extension for Joomla
ExploitedCritical10.0 - CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…
Fortinet · FortiClientEMS
ExploitedCritical9.1 - CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
vitejs · vite
ExploitedMedium5.3 - CVE-2025-12480
Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is…
TrioFox · TrioFox
ExploitedCritical9.1 - CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh8.8 - CVE-2025-59230
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
Newest CVEs
- CVE-2026-124458
OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpoint
openemr · openemr
High7.1 - CVE-2026-123603
Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypass
hickory-dns · hickory-dns
Medium6.9 - CVE-2026-123991
DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload
DataEase
Medium6.9 - CVE-2026-123881
OpenBMB Internet of Agents Message app.py fetch_chat_record access control
OpenBMB · Internet of Agents
Medium6.9 - CVE-2026-97191
Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path
Unknown · Advanced Custom Fields (ACF®)
Low2.7 - CVE-2026-123787
nexmoe VidBee Local HTTP Service local-api.ts information disclosure
nexmoe · VidBee
Medium5.3 - CVE-2026-103985
FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
freescout-help-desk · freescout
High7.1 - CVE-2026-49939
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
Apache Software Foundation · Apache James
Not scored - CVE-2026-118239
AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
Unknown · AutomatorWP
Medium5.6 - CVE-2026-104136
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
openemr · openemr
High7.1