cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 23

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 7.2CVE-2026-104890EPSS 0.4%

    Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getF…

  2. 3.6CVE-2026-77803EPSS 0.10%

    In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer…

  3. 6.3CVE-2026-77802EPSS 0.1%

    In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting valu…

  4. 9.3CVE-2026-105284EPSS 0.8%

    A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorizatio…

  5. 8.4CVE-2026-104811EPSS 0.2%

    DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists wit…

  6. 8.4CVE-2026-104809EPSS 0.10%

    DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without a…

  7. 8.5CVE-2026-104805EPSS 0.2%

    DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific …

  8. 5.1CVE-2026-103511EPSS 0.3%

    Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation …

  9. 7.5CVE-2026-103507EPSS 0.5%

    Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code …

  10. 2.9CVE-2026-105237EPSS 0.4%

    A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The mani…

  11. 2.0CVE-2026-105179EPSS 0.1%

    A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handler. Executing a manipulation of the argument Password can lead …

  12. 6.9CVE-2026-105163EPSS 0.3%

    A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use…

  13. 8.6CVE-2026-105126EPSS 0.5%

    LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin o…

  14. 8.7CVE-2026-105123EPSS 0.5%

    W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .…

  15. 6.0CVE-2026-105112EPSS 0.2%

    Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-de…

  16. 8.8CVE-2026-97644EPSS 0.5%

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_co…

  17. 1.8CVE-2026-105083EPSS 0.1%

    ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser co…

  18. 6.9CVE-2026-93474EPSS 0.2%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  19. 3.6CVE-2026-105043EPSS 0.1%

    MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.

  20. 9.3CVE-2023-54405EPSS 0.6%

    H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary fi…

  21. 2.0CVE-2026-104855EPSS 0.3%

    Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mu…

  22. 8.5CVE-2026-104854EPSS 0.1%

    Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and …

  23. 5.8CVE-2026-104853EPSS 0.2%

    Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained…

  24. 3.7CVE-2026-39601EPSS 0.2%

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

  25. 5.5CVE-2026-104637EPSS 0.3%

    A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_phy…

  26. 9.8CVE-2026-19652EPSS 0.3%

    The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress rol…

  27. 8.2CVE-2026-94636EPSS 0.3%

    Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apac…

  28. 8.6CVE-2026-104471EPSS 0.4%

    YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or …

  29. 8.7CVE-2026-104430EPSS 0.4%

    Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus …

  30. 5.3CVE-2026-104412EPSS 0.2%

    Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super …

  31. 5.3CVE-2026-91020EPSS 0.3%

    The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to s…

  32. 5.3CVE-2026-90987EPSS 0.2%

    The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.

  33. 8.1CVE-2026-92820EPSS 0.5%

    The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the…

  34. 8.8CVE-2026-15897EPSS 0.3%

    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its r…

  35. 7.5CVE-2026-103097EPSS 0.2%

    An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and …

  36. 7.5CVE-2026-103096EPSS 0.2%

    API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and mis…

  37. 5.6CVE-2026-71453EPSS 0.1%

    - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.

  38. 8.8CVE-2026-104051EPSS 0.5%

    PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadat…

  39. 9.1CVE-2026-56660EPSS 0.5%

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root wit…

  40. 5.6CVE-2026-27872EPSS 0.09%

    - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52.

  41. 8.7CVE-2026-104057EPSS 0.3%

    Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutin…

  42. 6.9CVE-2026-97662EPSS 0.1%

    An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended wor…

  43. 8.8CVE-2026-104018EPSS 0.6%

    An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the pri…

  44. 2.1CVE-2026-103923EPSS 0.3%

    KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting m…

  45. 7.5CVE-2026-63718EPSS 0.4%

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache H…

  46. 9.8CVE-2026-59797EPSS 0.5%

    Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

  47. 9.8CVE-2026-103752EPSS 0.3%

    Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.

  48. 5.5CVE-2026-103687EPSS 0.4%

    A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is poss…

  49. 8.8CVE-2026-103068EPSS 0.2%

    Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

  50. 8.5CVE-2026-103286EPSS 0.2%

    Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access …