While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
Volume of CVEs assigned to CWE-279 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-21699HIGH IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected vers | Jan 19, 2022 | 8.8 | 29 | NO | NO |
CVE-2024-25621HIGH containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an ov | Nov 6, 2025 | 7.8 | 28 | NO | NO |
CVE-2025-14025HIGH A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this v | Jan 8, 2026 | 8.5 | 27 | NO | NO |
CVE-2025-58437HIGH Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insec | Sep 6, 2025 | 8.1 | 27 | NO | NO |
CVE-2024-37734CRITICAL An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. | Jun 26, 2024 | 9.8 | 26 | NO | NO |
CVE-2026-46388MEDIUM osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file c | Jul 10, 2026 | 4.4 | 25 | NO | NO |
CVE-2025-12801MEDIUM A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the
privileges assigned to it in the /et | Mar 4, 2026 | 6.5 | 25 | NO | NO |
CVE-2025-30001HIGH Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark.
This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.
Users are recommended to upgrade to ve | Oct 10, 2025 | 7.3 | 25 | NO | NO |
CVE-2026-20062HIGH A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administra | Mar 4, 2026 | 7.2 | 24 | NO | NO |
CVE-2023-4665HIGH Incorrect Execution-Assigned Permissions vulnerability in Saphira Saphira Connect allows Privilege Escalation.
This issue affects Saphira Connect: before 9. | Sep 15, 2023 | 8.8 | 24 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.