CWE-425
256 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 256
- Last 12 months
- 55
- Critical
- 36
- Known exploited
- 2
Critical 36High 76Medium 129Low 10Not scored 5
CVEs per yearBy the year they were published
- 200511
- 20151
- 20177
- 201818
- 201924
- 202020
- 202117
- 202240
- 202318
- 202421
- 202531
- 202648
Known exploitedNewest addition to KEV first
- CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Apache Software Foundation · Apache OFBiz
ExploitedCritical9.8 - CVE-2021-26085
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability…
Atlassian · Confluence Server
ExploitedMedium5.3
Newest CVEs
- CVE-2026-85627
Apache OFBiz: Authenticated Code Execution Vulnerability
Apache Software Foundation · Apache OFBiz
High8.8 - CVE-2026-100168
Apache OFBiz: Missing Authorization vulnerability
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-105325
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-105461
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-109856
Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-114235
Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
Apache Software Foundation · Apache OFBiz
Not scored - CVE-2026-112144
satya-vinay Events-Management-System project.sql file access
satya-vinay · Events-Management-System
Medium6.9 - CVE-2026-108938
code-projects Matrimonial System matrimony.sql file access
code-projects · Matrimonial System
Medium6.9 - CVE-2026-87744
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
Red Hat · Red Hat build of Quarkus 3.27.6.redhat
Critical9.1 - CVE-2026-105046
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
Kentico · Xperience
Medium4.3