cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 17

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 5.3CVE-2026-89205EPSS 0.2%

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attac…

  2. 8.7CVE-2026-59241EPSS 0.3%

    A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the pe…

  3. 8.6CVE-2026-13138EPSS 0.2%

    Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.

  4. 2.1CVE-2026-109143EPSS 0.2%

    A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the ar…

  5. 5.5CVE-2026-108975EPSS 0.3%

    A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unr…

  6. 5.5CVE-2026-108974EPSS 0.3%

    A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launc…

  7. 5.5CVE-2026-108973EPSS 0.3%

    A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted uplo…

  8. 7.1CVE-2026-103316EPSS 0.1%

    The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code …

  9. 5.3CVE-2026-89271EPSS 0.2%

    The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary l…

  10. 4.3CVE-2026-105458EPSS 0.2%

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular per…

  11. 4.3CVE-2026-104661EPSS 0.2%

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with comp…

  12. 4.4CVE-2026-89106EPSS 0.1%

    SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on …

  13. 4.8CVE-2026-19936EPSS 0.1%

    The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronizatio…

  14. 4.4CVE-2026-18343EPSS 0.08%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

  15. 8.7CVE-2026-109667EPSS 0.2%

    Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any auth…

  16. 7.1CVE-2026-109601EPSS 0.3%

    Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referen…

  17. 8.7CVE-2024-58390EPSS 0.3%

    Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with We…

  18. 5.7CVE-2026-102539EPSS 0.2%

    Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, cau…

  19. 8.3CVE-2026-84319EPSS 0.3%

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allo…

  20. 8.8CVE-2026-84318EPSS 0.8%

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The iden…

  21. 8.8CVE-2026-84317EPSS 0.5%

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules,…

  22. 5.8CVE-2026-41508EPSS 0.5%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_…

  23. 7.2CVE-2026-18513EPSS 0.3%

    IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

  24. 8.6CVE-2026-109567EPSS 0.3%

    Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles …

  25. 8.2CVE-2026-109426EPSS 0.1%

    Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only …

  26. 7.8CVE-2026-95837EPSS 0.1%

    containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the …

  27. 7.2CVE-2026-41510EPSS 0.4%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlen…

  28. 2.1CVE-2026-108923EPSS 0.2%

    A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the a…

  29. 5.8CVE-2026-104774EPSS 0.3%

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing …

  30. 6.1CVE-2025-27902EPSS 0.2%

    IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions …

  31. 6.5CVE-2026-78404EPSS 0.09%

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

  32. 8.1CVE-2026-59976EPSS 0.8%

    ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is conf…

  33. 2.1CVE-2026-108922EPSS 0.3%

    A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/imag…

  34. 6.8CVE-2026-107226EPSS 0.3%

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response …

  35. 8.8CVE-2026-105465EPSS 0.10%

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

  36. 8.8CVE-2026-105464EPSS 0.09%

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

  37. 3.7CVE-2026-42689EPSS 0.2%

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.

  38. 5.3CVE-2026-103080EPSS 0.2%

    External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

  39. 6.9CVE-2026-109364EPSS 0.2%

    Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in thei…

  40. 8.5CVE-2026-109346EPSS 0.3%

    better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/…

  41. 7.5CVE-2026-109331EPSS 0.1%

    Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place da…

  42. 8.6CVE-2026-109317EPSS 0.4%

    Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edi…

  43. 7.1CVE-2026-109297EPSS 0.4%

    Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permit…

  44. 8.4CVE-2026-109290EPSS 0.3%

    Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk …

  45. 2.0CVE-2026-109279EPSS 0.09%

    ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer o…

  46. 9.6CVE-2026-85956EPSS 0.4%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized databa…

  47. 9.9CVE-2026-85955EPSS 0.6%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which c…

  48. 8.6CVE-2026-85954EPSS 0.3%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege es…

  49. 8.5CVE-2026-85953EPSS 0.4%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could res…

  50. 8.4CVE-2026-85950EPSS 0.3%

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-…