cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 156

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.8CVE-2026-65673EPSS 0.3%

    Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network.

  2. 8.8CVE-2026-65660KEVEPSS 8.2%

    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  3. 7.8CVE-2026-65656EPSS 0.5%

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

  4. 5.4CVE-2026-64922EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  5. 5.4CVE-2026-64916EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  6. 5.4CVE-2026-64902EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  7. 5.4CVE-2026-64900EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  8. 5.4CVE-2026-64897EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  9. 8.1CVE-2026-63520EPSS 1.0%

    Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  10. 4.6CVE-2026-62917EPSS 0.6%

    Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  11. 5.4CVE-2026-62914EPSS 0.4%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

  12. 8.8CVE-2026-62910EPSS 1.0%

    Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  13. 5.4CVE-2026-62829EPSS 0.5%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  14. 8.1CVE-2026-61363EPSS 0.7%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  15. 8.1CVE-2026-59134EPSS 0.7%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

  16. 5.4CVE-2026-57105EPSS 0.6%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  17. 9.6CVE-2026-57104EPSS 0.9%

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.

  18. 8.8CVE-2026-49179EPSS 0.9%

    Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

  19. 6.5CVE-2026-48436EPSS 0.7%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  20. 7.7CVE-2026-48385EPSS 1.6%

    ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerabili…

  21. 4.9CVE-2026-48384EPSS 1.0%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-…

  22. 5.4CVE-2026-48376EPSS 0.7%

    is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized w…

  23. 10.0CVE-2026-48362EPSS 3.5%

    ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could explo…

  24. 7.2CVE-2026-47299EPSS 1.0%

    Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.

  25. 6.5CVE-2026-47285EPSS 0.9%

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  26. 6.8CVE-2026-27765EPSS 0.1%

    Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a lo…

  27. 8.2CVE-2026-21279EPSS 0.8%

    is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploi…

  28. 8.7CVE-2026-21273EPSS 0.9%

    is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires…

  29. 5.4CVE-2026-21269EPSS 0.6%

    ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's brows…

  30. 4.8CVE-2026-20913EPSS 0.1%

    Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a lo…

  31. 8.2CVE-2026-20715EPSS 0.4%

    Improper input validation in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard Manageability may allow a denial of service. Network adversary with an unauthenticated user combined with a…

  32. 5.3CVE-2026-18247EPSS 0.4%

    A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session.

  33. 4.3CVE-2026-9214EPSS 0.2%

    Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

  34. 8.6CVE-2026-73078EPSS 0.3%

    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating atta…

  35. 8.4CVE-2026-73077EPSS 0.1%

    Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keyword…

  36. 8.4CVE-2026-73076EPSS 0.1%

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimbal…

  37. 9.1CVE-2026-73069EPSS 0.7%

    Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector …

  38. 7.5CVE-2026-67180EPSS 0.2%

    Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

  39. 7.8CVE-2026-67179EPSS 0.2%

    Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any r…

  40. 8.8CVE-2026-19546EPSS 0.4%

    A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-1954…

  41. 4.9CVE-2026-11814EPSS 2.2%

    A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of th…

  42. 4.9CVE-2026-11739EPSS 2.5%

    A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality…

  43. 4.3CVE-2026-11738EPSS 0.4%

    Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

  44. 4.3CVE-2026-11737EPSS 0.3%

    Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

  45. 1.9CVE-2026-11736EPSS 0.8%

    A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.

  46. 9.3CVE-2025-31114EPSS 0.9%

    Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may …

  47. 6.1CVE-2026-72925EPSS 0.3%

    SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controll…

  48. 10.0CVE-2026-48056EPSS 0.6%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to …

  49. 9.8CVE-2026-46670ExploitEPSS 2.0%

    YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary …

  50. 5.1CVE-2026-19434EPSS 0.5%

    Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend i…