cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 132

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 10.0CVE-2026-22238EPSS 0.7%

    The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to c…

  2. 5.5CVE-2025-71126EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported an MPTCP deadlock at fallback time: WARNING: possible recursive locking detected 6.18.0-rc7-virtme …

  3. 4.7CVE-2025-71111EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shar…

  4. 9.8CVE-2026-23550ExploitEPSS 21%

    Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1.

  5. 4.7CVE-2025-68969EPSS 0.07%

    Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability.

  6. 4.7CVE-2025-68962EPSS 0.07%

    Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  7. 4.7CVE-2025-68961EPSS 0.09%

    Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  8. 4.7CVE-2025-68960EPSS 0.09%

    Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  9. 4.7CVE-2025-68958EPSS 0.1%

    Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  10. 4.7CVE-2025-68957EPSS 0.1%

    Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  11. 4.7CVE-2025-68956EPSS 0.1%

    Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  12. 4.7CVE-2025-68955EPSS 0.1%

    Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability.

  13. 10.0CVE-2026-22686EPSS 0.8%

    Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in …

  14. 8.6CVE-2022-50939EPSS 1.3%

    e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload func…

  15. 8.7CVE-2022-50936EPSS 0.9%

    WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the ad…

  16. 8.5CVE-2022-50927EPSS 0.2%

    Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can exploit the default user configuration to gain root access …

  17. 8.7CVE-2022-50916EPSS 1.0%

    e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the up…

  18. 9.3CVE-2022-50912EPSS 1.2%

    ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.ph…

  19. 8.6CVE-2022-50907EPSS 1.2%

    e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating …

  20. 8.6CVE-2022-50898EPSS 1.3%

    NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory b…

  21. 9.3CVE-2022-50893EPSS 1.0%

    VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file through the add_gallery_image.php endpoint to execute arbitrary code …

  22. 10.0CVE-2026-23478EPSS 0.5%

    Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email ad…

  23. 7.8CVE-2025-37186EPSS 0.2%

    A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution…

  24. 7.2CVE-2025-37175EPSS 0.5%

    Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitr…

  25. 7.0CVE-2026-21221EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

  26. 7.5CVE-2026-20934EPSS 0.7%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  27. 8.0CVE-2026-20931EPSS 0.8%

    External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

  28. 5.3CVE-2026-20927EPSS 0.9%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network.

  29. 7.5CVE-2026-20926EPSS 0.8%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  30. 6.5CVE-2026-20925EPSS 18%

    External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

  31. 7.8CVE-2026-20924EPSS 0.3%

    Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

  32. 7.5CVE-2026-20921EPSS 1.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  33. 7.5CVE-2026-20919EPSS 0.8%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  34. 7.8CVE-2026-20918EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  35. 7.8CVE-2026-20877EPSS 0.3%

    Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

  36. 7.8CVE-2026-20874EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  37. 7.8CVE-2026-20873EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  38. 6.5CVE-2026-20872EPSS 20%

    External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

  39. 7.0CVE-2026-20869EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.

  40. 7.8CVE-2026-20867EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  41. 7.8CVE-2026-20866EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-20861EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

  43. 7.8CVE-2026-20858EPSS 0.3%

    Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

  44. 7.4CVE-2026-20853EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

  45. 7.7CVE-2026-20852EPSS 0.5%

    Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.

  46. 7.5CVE-2026-20849EPSS 1.0%

    Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

  47. 7.5CVE-2026-20848EPSS 0.7%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

  48. 7.4CVE-2026-20844EPSS 0.3%

    Use after free in Windows Clipboard Server allows an unauthorized attacker to elevate privileges locally.

  49. 7.0CVE-2026-20836EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

  50. 7.0CVE-2026-20830EPSS 0.3%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.