CWE-862: Missing authorization
11,698 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 12 of them as exploited in the wild.
- Published CVEs
- 11,698
- Last 12 months
- 5,776
- Critical
- 609
- Known exploited
- 12
Critical 609High 2,870Medium 7,856Low 347Not scored 16
CVEs per yearBy the year they were published
- 20121
- 20162
- 201743
- 201867
- 2019210
- 2020272
- 2021257
- 2022513
- 2023845
- 20241,908
- 20252,354
- 20265,220
Known exploitedNewest addition to KEV first
- CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9 - CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
kernel
ExploitedHigh7.8 - CVE-2024-57726
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions.…
Product not named
ExploitedCritical9.9 - CVE-2023-52163
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported…
Product not named
ExploitedHigh8.8 - CVE-2025-40602
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
SonicWall · SMA1000
ExploitedMedium6.6 - CVE-2025-6205
Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
Dassault Systèmes · DELMIA Apriso
ExploitedCritical9.1 - CVE-2025-20362
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases…
Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
ExploitedMedium6.5 - CVE-2021-39226
Snapshot authentication bypass in grafana
grafana · grafana
ExploitedCritical9.8 - CVE-2022-0543
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could…
Debian · redis
ExploitedCritical10.0 - CVE-2021-37976
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from…
Google · Chrome
ExploitedMedium6.5
Newest CVEs
- CVE-2026-124502
yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization
yungifez · Skuul School Management System
Medium5.3 - CVE-2026-77153
IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []
IBM · i
Medium4.8 - CVE-2026-2477
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
IBM · watsonx Orchestrate Cartridge for Cloud Pak for Data
Medium6.5 - CVE-2026-120115
Multiple vulnerabilities in IBM Aspera Connect
IBM · Aspera Connect
Medium6.3 - CVE-2026-114186
WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability
WPVibes · AnyWhere Elementor
Medium6.5 - CVE-2026-120858
WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability
WP ManageNinja LLC · FluentForm
Medium6.5 - CVE-2026-109899
WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability
Melapress · Melapress Role Editor
High7.1 - CVE-2026-124488
OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters
openemr · openemr
High8.6 - CVE-2026-124486
OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller
openemr · openemr
High8.7 - CVE-2026-124484
OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs
openemr · openemr
High8.7