# CWE-274.

Every Advisory and CVE whose sources give the weakness CWE-274, newest first.

## Records, newest first

- [Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions](https://agentprime.io/advisories/CVE-2026-62764.md)
  `CVE-2026-62764` · CVE record: Apache Software Foundation Apache Accumulo · CVSS 5.7 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-274
- [Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficient privileges and successfully write dat…](https://agentprime.io/advisories/CVE-2025-54511.md)
  `CVE-2025-54511` · CVE record: AMD MI-25 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-274
- [Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability](https://agentprime.io/advisories/GHSA-78cg-fc6c-w44w.md)
  `GHSA-78cg-fc6c-w44w`, `CVE-2026-33005` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=3.10, <9.0.0`, fixed in `9.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-274
- [Mastodon streaming API fails to disconnect disabled and suspended users](https://agentprime.io/advisories/CVE-2025-62175.md)
  `CVE-2025-62175` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-273, CWE-274
- [Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentially resulting in loss of confidentiality or integrity.](https://agentprime.io/advisories/CVE-2023-20516.md)
  `CVE-2023-20516` · CVE record: AMD AMD Instinct™ MI250 and 4 more · CVSS 3.3 Low · Not analysed yet · Published 6 Sept 2025 · Tags: CWE-274
- [spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL.](https://agentprime.io/advisories/CVE-2025-29365.md)
  `CVE-2025-29365` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2025 · Tags: Memory corruption, CWE-274
- [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2025-31275.md)
  `CVE-2025-31275` · CVE record: Apple macOS · CVSS 6.2 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-274
- [Cisco IOS XR Software Image Verification Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-20177.md)
  `CVE-2025-20177` · CVE record: Cisco Cisco IOS XR Software · CVSS 6.7 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-274
- [GPU DDK - Arbitrary write of read-only dmabuf](https://agentprime.io/advisories/CVE-2024-46974.md)
  `CVE-2024-46974` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 31 Jan 2025 · Tags: Privilege escalation, CWE-274
- [Cisco Meeting Management Client-Server Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2025-20156.md)
  `CVE-2025-20156` · CVE record: Cisco Cisco Meeting Management · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2025 · Tags: CWE-274
- [ClassCMS User Management Page admin insufficient privileges](https://agentprime.io/advisories/CVE-2024-12666.md)
  `CVE-2024-12666` · CVE record: ClassCMS · CVSS 5.1 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Privilege escalation, CWE-274
- [NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue.](https://agentprime.io/advisories/CVE-2024-0106.md)
  `CVE-2024-0106` · CVE record: NVIDIA BlueField 1 and 3 more · CVSS 8.7 High · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-274
- [NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue.](https://agentprime.io/advisories/CVE-2024-0105.md)
  `CVE-2024-0105` · CVE record: NVIDIA ConnectX4 and 4 more · CVSS 8.9 High · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-274
- [Amazon CloudWatch Agent for Windows has Privilege Escalation Vector in github.com/aws/amazon-cloudwatch-agent](https://agentprime.io/advisories/GHSA-j8x2-2m5w-j939.md)
  `GHSA-j8x2-2m5w-j939`, `CVE-2022-23511`, `GO-2022-1160` · Go `github.com/aws/amazon-cloudwatch-agent`: affected `<1.247355.0`, fixed in `1.247355.0` · CVSS 7.1 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-274
- [JupyterHub has a privilege escalation vulnerability with the \`admin:users\` scope](https://agentprime.io/advisories/GHSA-9x4q-3gxw-849f.md)
  `GHSA-9x4q-3gxw-849f`, `BIT-jupyterhub-2024-41942`, `CVE-2024-41942`, `PYSEC-2024-200` · PyPI `jupyterhub`: affected `<4.1.6 || >=5.0.0, <5.1.0`, fixed in `4.1.6`, `5.1.0` · CVSS 7.2 High · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-274
- [Cisco IOS XE Software: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated…](https://agentprime.io/advisories/CVE-2024-20324.md)
  `CVE-2024-20324` · CVE record: Cisco Cisco IOS XE Software · CVSS 5.5 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-274
- [XWiki has no right protection on rollback action](https://agentprime.io/advisories/GHSA-xh35-w7wg-95v3.md)
  `GHSA-xh35-w7wg-95v3`, `CVE-2024-21648` · Maven `org.xwiki.platform:xwiki-platform` and 1 more: affected `>=15.0-rc-1, <15.5.3 || >=15.6-rc-1, <15.8-rc-1`, fixed in `15.5.3`, `15.8-rc-1` · CVSS 8.0 High · Not analysed yet · Published 8 Jan 2024 · Tags: CWE-274
- [SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges](https://agentprime.io/advisories/CVE-2023-39375.md)
  `CVE-2023-39375` · CVE record: SiberianCMS SiberianCMS · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2023 · Tags: CWE-274
- [Dell PowerScale OneFS: Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient…](https://agentprime.io/advisories/CVE-2023-32494.md)
  `CVE-2023-32494` · CVE record: Dell PowerScale OneFS · CVSS 6.7 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: CWE-274
- [Nextcloud user scoped external storage can be used to gather credentials of other users](https://agentprime.io/advisories/CVE-2023-35928.md)
  `CVE-2023-35928` · CVE record: nextcloud security-advisories · CVSS 8.5 High · Not analysed yet · Published 23 Jun 2023 · Tags: CWE-274
- [Dell PowerScale OneFS: Dell PowerScale OneFS 9.0.0.x - 9.4.0.x…](https://agentprime.io/advisories/CVE-2022-45101.md)
  `CVE-2022-45101` · CVE record: Dell PowerScale OneFS · CVSS 7.3 High · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-274
- [JFrog Artifactory: JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass…](https://agentprime.io/advisories/CVE-2022-0668.md)
  `CVE-2022-0668` · CVE record: JFrog JFrog Artifactory · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2023 · Tags: CWE-274
- [Insufficient privilege checks on object access and updates.](https://agentprime.io/advisories/CVE-2022-25782.md)
  `CVE-2022-25782` · CVE record: Secomea GateManager · CVSS 5.4 Medium · Not analysed yet · Published 4 May 2022 · Tags: CWE-274
- [Dell PowerScale OneFS: Dell PowerScale OneFS, versions 8.2.0-9.3.0…](https://agentprime.io/advisories/CVE-2022-23160.md)
  `CVE-2022-23160` · CVE record: Dell PowerScale OneFS · CVSS 5.4 Medium · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-274
- [GateManager information leak for LinkManager Users](https://agentprime.io/advisories/CVE-2021-32006.md)
  `CVE-2021-32006` · CVE record: Secomea GateManager · CVSS 5.0 Medium · Not analysed yet · Published 7 Mar 2022 · Tags: CWE-274, CWE-275
- [Insufficient Security Control Vulnerability](https://agentprime.io/advisories/CVE-2021-35534.md)
  `CVE-2021-35534` · CVE record: Hitachi Energy Relion 670 Series and 4 more · CVSS 7.2 High · Not analysed yet · Published 18 Nov 2021 · Tags: CWE-274
- [Insecure Windows Services in Symphony Plus](https://agentprime.io/advisories/CVE-2020-24676.md)
  `CVE-2020-24676` · CVE record: ABB ABB Ability™ Symphony® Plus Operations and 1 more · CVSS 7.8 High · Not analysed yet · Published 22 Dec 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in McAfee Total Protection (MTP)](https://agentprime.io/advisories/CVE-2020-7283.md)
  `CVE-2020-7283` · CVE record: McAfee,LLC McAfee Total Protection (MTP) · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in MAR for Linux](https://agentprime.io/advisories/CVE-2020-7290.md)
  `CVE-2020-7290` · CVE record: McAfee,LLC McAfee Active Response (MAR) for Linux · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability MAR for Mac](https://agentprime.io/advisories/CVE-2020-7291.md)
  `CVE-2020-7291` · CVE record: McAfee,LLC McAfee Active Response (MAR) for Mac · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in EDR for Linux](https://agentprime.io/advisories/CVE-2020-7287.md)
  `CVE-2020-7287` · CVE record: McAfee,LLC McAfee Exploit Detection and Response (EDR) for Linux · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in EDR for Mac](https://agentprime.io/advisories/CVE-2020-7288.md)
  `CVE-2020-7288` · CVE record: McAfee,LLC McAfee Exploit Detection and Response (EDR) for Mac · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in MAR for Windows](https://agentprime.io/advisories/CVE-2020-7289.md)
  `CVE-2020-7289` · CVE record: McAfee,LLC McAfee Active Response (MAR) for Windows · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in MVISION Endpoint](https://agentprime.io/advisories/CVE-2020-7285.md)
  `CVE-2020-7285` · CVE record: McAfee,LLC McAfee MVISION Endpoint · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability in EDR for Windows](https://agentprime.io/advisories/CVE-2020-7286.md)
  `CVE-2020-7286` · CVE record: McAfee,LLC McAfee Exploit Detection and Response (EDR) for Windows · CVSS 7.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability through symbolic links in VSEL](https://agentprime.io/advisories/CVE-2020-7267.md)
  `CVE-2020-7267` · CVE record: McAfee,LLC McAfee VirusScan Enterprise (VSE) for Linux · CVSS 8.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability through symbolic links in VSE for Windows](https://agentprime.io/advisories/CVE-2020-7266.md)
  `CVE-2020-7266` · CVE record: McAfee,LLC McAfee VirusScan Enterprise (VSE) for Windows · CVSS 8.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability through symbolic links in ENSM](https://agentprime.io/advisories/CVE-2020-7265.md)
  `CVE-2020-7265` · CVE record: McAfee,LLC McAfee Endpoint Security (ENS) for Mac · CVSS 8.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Privilege Escalation vulnerability through symbolic links in ENS for Windows](https://agentprime.io/advisories/CVE-2020-7264.md)
  `CVE-2020-7264` · CVE record: McAfee,LLC McAfee Endpoint Security (ENS) for Windows · CVSS 8.8 High · Not analysed yet · Published 8 May 2020 · Tags: CWE-274
- [Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2018-6693.md)
  `CVE-2018-6693` · CVE record: McAfee Endpoint Security for Linux Threat Prevention (ENSLTP) · CVSS 5.6 Medium · Not analysed yet · Published 18 Sept 2018 · Tags: CWE-274, CWE-363
- [McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass](https://agentprime.io/advisories/CVE-2017-3912.md)
  `CVE-2017-3912` · CVE record: McAfee McAfee Application Control and Change Control (MACC) · CVSS 4.4 Medium · Not analysed yet · Published 18 Sept 2018 · Tags: CWE-274
- [Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges](https://agentprime.io/advisories/CVE-2018-6674.md)
  `CVE-2018-6674` · CVE record: McAfee, LLC VirusScan Enterprise (VSE) · CVSS 6.8 Medium · Not analysed yet · Published 25 May 2018 · Tags: Privilege escalation, CWE-264, CWE-274

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-274>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-274/>. Everything for agents: <https://agentprime.io/llms.txt>.