OWASP A05:2025 Injection vulnerabilities, newest first, page 155
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.
Its weaknesses: 37
CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917
- 7.8CVE-2026-68446EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM…
- 5.4CVE-2026-73250EPSS 0.2%
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerS…
- 8.5CVE-2026-73248EPSS 0.2%
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inheri…
- 8.6CVE-2026-5917EPSS 1.4%
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supply…
- 7.8CVE-2026-66150EPSS 0.3%
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands …
- 7.8CVE-2026-66149EPSS 0.3%
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands …
- 6.3CVE-2026-66148EPSS 1.1%
An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges.
- 9.4CVE-2026-66147EPSS 1.8%
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.
- 8.7CVE-2026-14863EPSS 2.5%
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substit…
- 8.5CVE-2026-73233EPSS 0.2%
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, …
- 7.8CVE-2026-73231EPSS 0.2%
Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fak…
- 9.4CVE-2026-73032EPSS 0.6%
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attac…
- 8.2CVE-2026-73031EPSS 0.7%
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The …
- 6.1CVE-2026-66146EPSS 0.3%
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
- 9.1CVE-2026-66145EPSS 0.7%
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
- 8.7CVE-2026-48813EPSS 0.4%
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injec…
- 10.0CVE-2026-45618EPSS 0.8%
LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.
- 8.8CVE-2026-73224EPSS 0.7%
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Pr…
- 8.8CVE-2026-73222EPSS 0.3%
Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits …
- 5.3CVE-2026-18708EPSS 0.4%
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value proc…
- 9.8CVE-2026-73211EPSS 0.7%
PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to r…
- 8.7CVE-2026-48414EPSS 0.3%
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's b…
- 8.7CVE-2026-48413EPSS 0.7%
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's b…
- 9.0CVE-2026-48381EPSS 0.8%
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…
- 4.0CVE-2026-20901EPSS 0.10%
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. T…
- 8.7CVE-2022-50997EPSS 0.6%
Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id G…
- 8.7CVE-2016-20097EPSS 0.6%
Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, wh…
- 6.1CVE-2026-73084EPSS 0.4%
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafte…
- 8.7CVE-2026-73081EPSS 0.5%
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A s…
- 4.0CVE-2026-71390EPSS 0.3%
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write…
- 8.8CVE-2026-71386EPSS 0.5%
is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is…
- 8.7CVE-2026-70355EPSS 0.8%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 7.8CVE-2026-70338EPSS 0.4%
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
- 8.8CVE-2026-70336EPSS 0.8%
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-70335EPSS 0.5%
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- 5.5CVE-2026-70325EPSS 0.4%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70323EPSS 0.4%
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70322EPSS 0.4%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70320EPSS 0.4%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70319EPSS 0.4%
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70318EPSS 0.5%
Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70316EPSS 0.4%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70314EPSS 0.5%
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
- 7.8CVE-2026-70313EPSS 0.5%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 5.5CVE-2026-70312EPSS 0.4%
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
- 9.3CVE-2026-70306EPSS 1.0%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- 8.8CVE-2026-69320EPSS 0.9%
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 7.8CVE-2026-68792EPSS 0.3%
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2026-65811EPSS 1.0%
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
- 7.6CVE-2026-65767EPSS 0.6%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network.