CWE-863: Incorrect authorization
4,882 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 22 of them as exploited in the wild.
- 4,882Published CVEs4,869 of them scored
- 2,543Last 12 monthspublished in the last year
- 448Critical1,713 more rated high
- 22Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-71362
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe · Adobe Commerce
ExploitedCritical9.1 - CVE-2026-42016
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
jfrog · artifactory
ExploitedHigh8.1 - CVE-2025-54253
Adobe Experience Manager | Incorrect Authorization (CWE-863)
Adobe · Adobe Experience Manager
ExploitedCritical10.0 - CVE-2025-55177
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…
Facebook · WhatsApp Desktop for Mac
ExploitedMedium5.4 - CVE-2025-21479
Incorrect Authorization in Graphics
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-21480
Incorrect Authorization in Graphics Windows
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.6 - CVE-2025-24200
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS…
Apple · iOS and iPadOS
ExploitedMedium6.1 - CVE-2024-21287
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version…
Oracle Corporation · Oracle Agile PLM Framework
ExploitedHigh7.5 - CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache Software Foundation · Apache OFBiz
ExploitedHigh8.1 - CVE-2021-40655
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request…
Product not named
ExploitedHigh7.5