cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 22

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 10.0CVE-2026-39773EPSS 0.3%

    Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

  2. 10.0CVE-2026-39770EPSS 0.4%

    Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

  3. 7.2CVE-2026-39765EPSS 0.4%

    Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

  4. 9.8CVE-2026-39761EPSS 0.4%

    Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

  5. 9.9CVE-2026-39759EPSS 0.4%

    Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

  6. 9.9CVE-2026-39757EPSS 0.4%

    Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

  7. 9.9CVE-2026-39755EPSS 0.4%

    Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

  8. 9.8CVE-2026-39753EPSS 0.4%

    Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

  9. 10.0CVE-2026-32579EPSS 0.5%

    Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.

  10. 8.8CVE-2026-105070EPSS 0.3%

    Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

  11. 8.8CVE-2026-105058EPSS 0.3%

    Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

  12. 7.2CVE-2026-104757EPSS 0.3%

    Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

  13. 8.1CVE-2026-104405EPSS 0.3%

    Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

  14. 8.8CVE-2026-105701EPSS 0.5%

    The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandb…

  15. 6.5CVE-2026-97300EPSS 0.2%

    Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

  16. 2.1CVE-2026-105621EPSS 0.2%

    A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Up…

  17. 2.0CVE-2026-105611EPSS 0.2%

    A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail…

  18. 2.0CVE-2026-105610EPSS 0.2%

    A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Para…

  19. 5.5CVE-2026-105571EPSS 0.3%

    A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper a…

  20. 7.5CVE-2026-82988EPSS 0.5%

    There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenti…

  21. 9.6CVE-2026-105763EPSS 0.3%

    Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a works…

  22. 4.3CVE-2026-105748EPSS 0.3%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py …

  23. 5.3CVE-2026-105746EPSS 0.2%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.p…

  24. 8.8CVE-2026-105744EPSS 0.4%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/back…

  25. 5.3CVE-2026-105742EPSS 0.3%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forw…

  26. 7.3CVE-2026-105773EPSS 0.1%

    Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary cod…

  27. 7.8CVE-2026-78860EPSS 0.1%

    An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

  28. 6.7CVE-2026-105688EPSS 0.3%

    Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and …

  29. 4.9CVE-2026-105687EPSS 0.3%

    Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can…

  30. 7.3CVE-2026-105679EPSS 0.2%

    Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restrict…

  31. 4.3CVE-2026-105678EPSS 0.2%

    Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. …

  32. 4.9CVE-2026-105676EPSS 0.4%

    Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potential…

  33. 7.3CVE-2026-105651EPSS 0.3%

    Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, includi…

  34. 7.3CVE-2026-105649EPSS 0.3%

    Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to ho…

  35. 2.1CVE-2026-105389EPSS 0.2%

    A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such mani…

  36. 7.0CVE-2026-58880EPSS 0.07%

    In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…

  37. 7.8CVE-2026-58841EPSS 0.07%

    In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…

  38. 7.8CVE-2026-28647EPSS 0.07%

    In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User inter…

  39. 7.8CVE-2026-28641EPSS 0.07%

    In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri…

  40. 7.8CVE-2026-28625EPSS 0.07%

    In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  41. 6.8CVE-2026-105644EPSS 0.3%

    Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the s…

  42. 7.3CVE-2026-105643EPSS 0.3%

    Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in po…

  43. 8.1CVE-2026-105634EPSS 0.3%

    Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorizat…

  44. 8.8CVE-2026-104714EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the applicati…

  45. 8.7CVE-2026-105630EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlle…

  46. 8.4CVE-2026-86671EPSS 0.3%

    In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host all…

  47. 5.5CVE-2026-105382EPSS 0.3%

    A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This mani…

  48. 8.1CVE-2026-104970EPSS 0.3%

    Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs acco…

  49. 5.4CVE-2026-104955EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to…

  50. 8.7CVE-2026-104892EPSS 0.2%

    Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in…