cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 109

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 7.8CVE-2026-32160EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  2. 7.8CVE-2026-32159EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  3. 7.8CVE-2026-32158EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  4. 7.8CVE-2026-32153EPSS 0.2%

    Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

  5. 7.0CVE-2026-32150EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

  6. 7.0CVE-2026-32093EPSS 1.1%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

  7. 7.0CVE-2026-32091EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

  8. 7.0CVE-2026-32090EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-32089EPSS 0.2%

    Use after free in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.

  10. 5.7CVE-2026-32088EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.

  11. 7.0CVE-2026-32086EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

  12. 7.0CVE-2026-32083EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

  13. 7.0CVE-2026-32082EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-32068EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

  15. 7.0CVE-2026-27927EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

  16. 7.0CVE-2026-27926EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-27921EPSS 1.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  18. 7.0CVE-2026-27918EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

  19. 7.8CVE-2026-27911EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

  20. 7.8CVE-2026-26181EPSS 0.2%

    Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  21. 7.0CVE-2026-26174EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

  22. 7.0CVE-2026-26173EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  23. 7.8CVE-2026-26172EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  24. 7.8CVE-2026-26168EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  25. 7.8CVE-2026-26167EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  26. 7.0CVE-2026-25184EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

  27. 7.8CVE-2026-20930EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  28. 6.7CVE-2026-0390EPSS 0.3%

    Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

  29. 6.8CVE-2026-22692EPSS 0.4%

    October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the …

  30. 8.8CVE-2026-38529EPSS 0.6%

    A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a craf…

  31. 9.9CVE-2026-38526ExploitEPSS 3.8%

    An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.

  32. 2.7CVE-2026-27316EPSS 0.3%

    A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentia…

  33. 6.5CVE-2026-22576EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  34. 6.5CVE-2026-22574EPSS 0.3%

    A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 thro…

  35. 9.1CVE-2026-2332EPSS 1.3%

    In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/20…

  36. 8.7CVE-2026-27668EPSS 0.3%

    A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators are allowed to administer groups they belong to. This could allow an authenticated User Administrato…

  37. 3.1CVE-2026-39419EPSS 0.2%

    MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UU…

  38. 7.4CVE-2026-39421EPSS 0.3%

    MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to execute raw system calls, an authenticated attacke…

  39. 7.4CVE-2026-39420EPSS 0.5%

    MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the LD_PRELOAD-based sandbox. By env command…

  40. 4.3CVE-2026-34262EPSS 0.3%

    Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

  41. 4.2CVE-2026-24318EPSS 0.2%

    Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If …

  42. 5.5CVE-2026-40311EPSS 0.2%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from a…

  43. 2.1CVE-2026-6201EPSS 0.3%

    A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to impr…

  44. 8.7CVE-2026-40040EPSS 0.5%

    Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files …

  45. 8.6CVE-2026-30804EPSS 0.4%

    Unrestricted Upload of File with Dangerous Type vulnerability allows Remote Code Execution via file upload. This issue affects Pandora FMS: from 777 through 800

  46. 7.8CVE-2026-31419EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clone…

  47. 4.7CVE-2026-34862EPSS 0.06%

    Race condition vulnerability in the power consumption statistics module. Impact: Successful exploitation of this vulnerability may affect availability.

  48. 4.7CVE-2026-34861EPSS 0.06%

    Race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability.

  49. 4.1CVE-2026-34858EPSS 0.07%

    UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

  50. 5.5CVE-2026-34857EPSS 0.07%

    UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.