cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 42

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 6.5CVE-2026-77909EPSS 0.6%

    Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.

  2. 7.0CVE-2026-77894EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

  3. 6.8CVE-2026-77892EPSS 0.4%

    No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.

  4. 7.0CVE-2026-73005EPSS 0.2%

    Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.

  5. 6.4CVE-2026-70582EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

  6. 5.9CVE-2026-70091EPSS 0.7%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network.

  7. 8.1CVE-2026-69827EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

  8. 8.1CVE-2026-69805EPSS 0.5%

    External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

  9. 7.8CVE-2026-69799EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.

  10. 4.7CVE-2026-69792EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to bypass a security feature locally.

  11. 8.1CVE-2026-69782EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

  12. 7.5CVE-2026-69710EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.

  13. 7.0CVE-2026-69682EPSS 0.2%

    Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

  14. 7.0CVE-2026-69581EPSS 0.2%

    Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

  15. 7.0CVE-2026-69448EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

  16. 7.0CVE-2026-69441EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

  17. 7.0CVE-2026-69404EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  18. 7.0CVE-2026-69398EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

  19. 7.0CVE-2026-69385EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2026-69383EPSS 0.4%

    External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.

  21. 7.1CVE-2026-69364EPSS 0.4%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.

  22. 8.8CVE-2026-69355EPSS 0.9%

    External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

  23. 7.0CVE-2026-69319EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

  24. 7.0CVE-2026-68840EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.

  25. 5.5CVE-2026-68830EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

  26. 7.0CVE-2026-68824EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

  27. 8.8CVE-2026-66818EPSS 0.8%

    Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.

  28. 6.5CVE-2026-64918EPSS 0.9%

    Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

  29. 7.8CVE-2026-62804EPSS 0.6%

    External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  30. 5.5CVE-2026-54611EPSS 0.7%

    InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possibl…

  31. 7.0CVE-2026-50349EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  32. 9.4CVE-2026-82533EPSS 1.2%

    DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the act…

  33. 7.1CVE-2026-82070EPSS 0.3%

    A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are …

  34. 4.3CVE-2026-86853EPSS 0.3%

    A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Fire…

  35. 7.1CVE-2026-86726EPSS 0.4%

    AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fail…

  36. 5.5CVE-2026-86666EPSS 0.5%

    A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotel…

  37. 8.2CVE-2026-86600EPSS 0.5%

    In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify th…

  38. 7.7CVE-2026-9040EPSS 0.1%

    A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing…

  39. 9.3CVE-2026-61516EPSS 0.7%

    Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management i…

  40. 6.5CVE-2026-62437EPSS 0.10%

    When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early i…

  41. 8.3CVE-2026-19203EPSS 0.3%

    A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by J…

  42. 8.2CVE-2026-77968EPSS 0.4%

    A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the Servi…

  43. 6.1CVE-2026-77654EPSS 0.1%

    Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privilege Escalation and Parameter Injection. A local user with access to the command line may escalate …

  44. 7.5CVE-2026-85400EPSS 0.5%

    Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is norma…

  45. 8.9CVE-2026-50093EPSS 0.3%

    A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 …

  46. 6.5CVE-2026-81792EPSS 0.3%

    Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privilege Escalation.This issue affects Product Catalog Enquiry for WooCommerce by Mult…

  47. 5.1CVE-2026-86516EPSS 0.4%

    A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script…

  48. 2.1CVE-2026-86512EPSS 0.4%

    A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Ope…

  49. 9.4CVE-2026-76969EPSS 0.4%

    @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive cr…

  50. 9.0CVE-2026-66768EPSS 0.6%

    SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger a…