cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 49

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 4.3CVE-2026-78979EPSS 0.2%

    Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  2. 5.4CVE-2026-78974EPSS 0.2%

    UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  3. 8.3CVE-2026-78934EPSS 0.3%

    Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  4. 7.5CVE-2026-78915EPSS 0.1%

    Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)

  5. 5.4CVE-2026-78912EPSS 0.3%

    UI misrepresentation in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  6. 7.5CVE-2026-78906EPSS 0.4%

    Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  7. 7.5CVE-2026-78901EPSS 0.3%

    Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  8. 6.1CVE-2026-65087EPSS 0.2%

    NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering.

  9. 8.8CVE-2026-43670EPSS 0.2%

    A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted…

  10. 3.3CVE-2026-43657EPSS 0.1%

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps.

  11. 7.1CVE-2026-80050EPSS 0.3%

    ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, s…

  12. 7.1CVE-2026-55609EPSS 0.2%

    sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in…

  13. 5.3CVE-2026-55419EPSS 0.5%

    Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound method in src/reachy_mini/daemon/app/routers/media.py without au…

  14. 8.6CVE-2026-75496EPSS 1.0%

    Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable …

  15. 7.5CVE-2026-55553EPSS 0.7%

    urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origin…

  16. 6.0CVE-2026-47624EPSS 0.2%

    NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi.

  17. 7.5CVE-2026-19913EPSS 0.6%

    The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and acce…

  18. 9.3CVE-2026-79774EPSS 0.8%

    Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. A…

  19. 8.8CVE-2026-79674EPSS 0.4%

    NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpu…

  20. 8.4CVE-2026-55581EPSS 0.5%

    mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and chec…

  21. 7.1CVE-2026-55527EPSS 0.5%

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON da…

  22. 9.8CVE-2026-16286EPSS 0.6%

    Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This iss…

  23. 4.8CVE-2026-79670EPSS 0.3%

    Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SV…

  24. 7.2CVE-2026-75971EPSS 0.6%

    The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being…

  25. 8.6CVE-2026-12878EPSS 0.4%

    In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

  26. 6.0CVE-2026-77139EPSS 0.4%

    The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containin…

  27. 8.8CVE-2026-16601EPSS 1.2%

    The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insuffic…

  28. 7.1CVE-2026-78679EPSS 0.3%

    GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbit…

  29. 8.6CVE-2026-78675EPSS 0.2%

    GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules fil…

  30. 8.7CVE-2026-76846EPSS 0.3%

    Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig t…

  31. 8.7CVE-2026-76839EPSS 0.3%

    Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User obj…

  32. 9.3CVE-2026-56705EPSS 0.9%

    Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP c…

  33. 7.1CVE-2026-56702EPSS 0.6%

    Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can uploa…

  34. 5.3CVE-2026-34967EPSS 0.3%

    Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to…

  35. 9.8CVE-2026-78267EPSS 0.5%

    Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.

  36. 5.9CVE-2026-45404EPSS 0.1%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for …

  37. 8.8CVE-2026-32561EPSS 0.4%

    Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

  38. 9.9CVE-2026-32559EPSS 0.5%

    Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions.

  39. 9.4CVE-2026-78555EPSS 0.4%

    RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form field…

  40. 7.1CVE-2026-71511EPSS 0.4%

    Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can c…

  41. 7.2CVE-2026-21756EPSS 0.5%

    HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.

  42. 9.8CVE-2026-66648EPSS 0.5%

    Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

  43. 9.8CVE-2026-32558EPSS 0.5%

    Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

  44. 9.8CVE-2026-28165EPSS 0.5%

    Unauthenticated Privilege Escalation in Digits <= 9.2 versions.

  45. 4.8CVE-2026-78337EPSS 0.4%

    Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in…

  46. 5.5CVE-2026-78245EPSS 0.5%

    A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead t…

  47. 7.5CVE-2026-75931EPSS 0.4%

    fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no…

  48. 5.5CVE-2026-78202EPSS 0.5%

    A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote…

  49. 5.1CVE-2026-19852EPSS 0.3%

    NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

  50. 8.7CVE-2026-78208EPSS 0.5%

    exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it …