CWE-280: CWE-280
Yearly Trend
Top Affected Vendors
All CWE-280 CVEs (58)
A privilege escalation vulnerability in Automai Director v.25.2.0 allows remote attackers to gain elevated privileges on affected systems. This affect...
Jan 12, 2026This CVE describes an authorization bypass vulnerability in Pixelfed that allows attackers to access administrative and moderator functionality beyond...
Feb 12, 2024This vulnerability allows kernel software running in an untrusted execution environment to leak sensitive information from the trusted execution envir...
Aug 9, 2025A privilege escalation vulnerability in Ruijie RG-NBS2009G-P switches allows remote attackers to gain administrative access via the system/config_menu...
Oct 2, 2024The OPPO Usercenter Credit SDK contains a privilege escalation vulnerability due to improper permission checks. This allows attackers to access intern...
Feb 20, 2024CVE-2025-58770 is a BIOS vulnerability in AMI APTIOV firmware that allows local attackers to bypass permission checks and escalate privileges. This af...
Dec 12, 2025This vulnerability allows non-privileged users to use ptrace system calls to write to GPU read-only memory, potentially bypassing memory protection me...
Aug 4, 2025This vulnerability allows unauthenticated attackers to read and write arbitrary files on affected devices via directory traversal in a web service end...
Jul 2, 2025This vulnerability in Webmin's ajaxterm module allows unauthorized users to hijack console sessions when insufficient permissions are improperly handl...
Jul 10, 2024This vulnerability allows authenticated users on Elspec G5 digital fault recorders to escalate privileges from user to administrative level by exploit...
Mar 20, 2024This vulnerability in Dell Update Package (DUP) Framework allows low-privileged local attackers to elevate their privileges to higher levels. It affec...
Feb 12, 2026Dell Update Package Framework versions before 22.01.02 contain a local privilege escalation vulnerability. A local low-privileged attacker can exploit...
Jan 7, 2025This authentication bypass vulnerability in Moodle allows suspended users to authenticate through the LTI Provider, enabling unauthorized access to th...
Feb 3, 2026A regression in FileRise version 1.4.0 allows low-privilege users to infer folder visibility and ownership based on folder names, potentially accessin...
Oct 20, 2025CVE-2024-6302 is a privilege escalation vulnerability in Conduit Matrix servers where local users can redact any message from users on the same server...
Jun 25, 2024This vulnerability allows an authenticated attacker with limited privileges to elevate their access rights on Windows systems through improper handlin...
Jan 13, 2026A permissions vulnerability in macOS allows applications to gain root privileges through improper access restrictions. This affects macOS Tahoe and Se...
Dec 12, 2025This vulnerability allows non-privileged users to exploit GPU driver flaws to write to arbitrary physical memory pages. It affects systems with Imagin...
Jun 2, 2025CVE-2025-3931 is an authentication bypass vulnerability in Yggdrasil's DBus component that allows any local system user to dispatch messages to worker...
May 14, 2025This CVE describes an improper authentication logic implementation in a file system module that could allow unauthorized access to sensitive data. Suc...
May 6, 2025This CVE describes a memory write permission bypass vulnerability in the Linux kernel's futex (fast userspace mutex) module. Attackers could potential...
Apr 7, 2025This vulnerability allows non-privileged software to perform unauthorized GPU system calls that can read and write arbitrary physical memory pages. Th...
Mar 24, 2025This vulnerability allows non-privileged software to exploit GPU kernel driver flaws to write to read-only system files mapped into application memory...
Dec 28, 2024This vulnerability allows local attackers to escalate privileges on Windows systems by placing malicious DLL files in the Foxit PDF update-service fol...
Apr 15, 2024This vulnerability allows a process to gain administrative privileges without proper authentication on affected macOS versions. It affects macOS Ventu...
Mar 28, 2024This CVE describes an intent redirection vulnerability in Android's DreamService component that allows local attackers to launch arbitrary protected a...
Feb 16, 2024This GPU driver vulnerability allows non-privileged software to bypass read-only memory protections and gain write access to GPU memory buffers. This ...
Nov 17, 2025Dell Repository Manager versions 3.4.7 and 3.4.8 contain a privilege escalation vulnerability where a low-privileged local attacker can gain elevated ...
Sep 29, 2025An authenticated user without administrative privileges can change the administrator account name in affected systems. This vulnerability affects syst...
May 12, 2025This vulnerability allows attackers to bypass package name verification in the HwIms module on Huawei devices running HarmonyOS. Successful exploitati...
Apr 8, 2024This CVE describes an insufficient permission verification vulnerability in the app management module of Huawei/HarmonyOS devices. Successful exploita...
Apr 7, 2024A vulnerability in the Common-Services 'So Flexibilite' module for PrestaShop allows remote attackers to access debug files containing sensitive infor...
Mar 3, 2024This vulnerability in M-Files Client allows UI extension applications to bypass access permission checks, enabling privilege escalation. Attackers cou...
May 25, 2023A permissions vulnerability in Xuxueli xxl-job versions 2.2.0, 2.3.0, and 2.3.1 allows attackers to obtain sensitive information via the pageList para...
Mar 21, 2023This CVE describes an Insecure Direct Object Reference vulnerability in HYPR Server that allows authenticated attackers to add FIDO2 authenticators to...
Jul 19, 2022CVE-2025-29826 is a privilege escalation vulnerability in Microsoft Dataverse where improper handling of insufficient permissions allows authenticated...
May 13, 2025CVE-2021-37851 is a local privilege escalation vulnerability in ESET Windows security products that allows authenticated local users to exploit the re...
May 11, 2022This GPU driver vulnerability allows non-privileged users to make improper GPU system calls that can write to arbitrary physical memory pages. This co...
Apr 4, 2025This vulnerability in Samsung Telecom allows untrusted applications to launch arbitrary activities due to an unprotected dynamic receiver. It affects ...
Feb 11, 2022This vulnerability in the Gutenberg Template Library & Redux Framework WordPress plugin allows users with 'edit_posts' capability (like contributors) ...
Sep 2, 2021This vulnerability allows authenticated attackers to execute arbitrary commands as root on ABB AC500 V3 PLCs after exploiting CVE-2024-12429 (director...
Jan 7, 2025Dell PowerScale OneFS versions 8.2x through 9.5x contain a local privilege escalation vulnerability. A local attacker with existing high privileges ca...
Aug 16, 2023This vulnerability allows low-privileged users in Checkmk monitoring systems to access agent information through the REST API without proper authoriza...
Dec 18, 2025This vulnerability allows remote authenticated users with Network Administrator privileges in Infinera G42 version R6.1.3 to read and write arbitrary ...
Jul 2, 2025This vulnerability in Hitachi Vantara Pentaho Business Analytics Server allows attackers to cause denial of service by exploiting improper handling of...
Feb 20, 2025This vulnerability allows users with Dynamic Group viewing permissions to see all member objects within those groups, bypassing normal object-level pe...
May 28, 2024This vulnerability in JetBrains TeamCity allows GitHub App tokens to be used beyond their intended project scope, potentially enabling unauthorized ac...
May 16, 2024This vulnerability allows low-privileged users in Checkmk to bypass permission checks on REST API endpoints, enabling unauthorized actions or access t...
Nov 18, 2025CVE-2025-24029 is an improper permissions vulnerability in Tuleap that allows users (including anonymous users in public project dashboards) to access...
Feb 3, 2025This vulnerability in Tuleap allows users to receive email notifications containing information they shouldn't have access to, potentially exposing se...
Oct 14, 2024About CWE-280 (CWE-280)
Our database tracks 58 CVEs classified as CWE-280, with 5 rated critical and 36 rated high severity. The average CVSS score for CWE-280 vulnerabilities is 7.2.
External reference: View CWE-280 on MITRE CWE →
Monitor CWE-280 Vulnerabilities
Get alerted when new CWE-280 CVEs affect your infrastructure.
Start Monitoring Free