cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 83

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 6.3CVE-2026-13748EPSS 0.2%

    Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or p…

  2. 10.0CVE-2026-56290KEVExploitEPSS 31%

    Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and l…

  3. 7.5CVE-2026-13676EPSS 0.7%

    fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its o…

  4. 5.5CVE-2026-13568EPSS 0.5%

    A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument rol…

  5. 8.6CVE-2026-13165EPSS 0.7%

    SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers). An attacker who cont…

  6. 6.5CVE-2026-13601EPSS 0.2%

    A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS…

  7. 5.5CVE-2026-13553EPSS 0.5%

    A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown function of the file /admin/mod_amenities/controller.php?action=add. Executing a manipulation of the argument image can lead to unrestricted u…

  8. 7.3CVE-2026-22078EPSS 0.1%

    Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

  9. 5.5CVE-2026-13547EPSS 0.5%

    A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue affects some unknown processing of the file /manage/resourceUpload/upload.do. Executing a manipulation of the argument File can lead to unrest…

  10. 2.1CVE-2026-13544EPSS 0.4%

    A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The …

  11. 6.8CVE-2025-7386EPSS 0.4%

    Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8: before DKCMAIN Ver. 90-09-24-00/00, SVP Ver. 90-09-24/00, before…

  12. 2.9CVE-2026-13524EPSS 0.4%

    A security vulnerability has been detected in CherryHQ cherry-studio up to 1.9.6. This vulnerability affects unknown code of the file src/main/services/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Server. The manipulatio…

  13. 1.3CVE-2026-13511EPSS 0.3%

    A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a man…

  14. 1.1CVE-2026-13502EPSS 0.1%

    A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This man…

  15. 6.3CVE-2026-58055EPSS 0.3%

    nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content…

  16. 9.4CVE-2026-58053EPSS 0.4%

    Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while mer…

  17. 4.8CVE-2026-58052EPSS 0.2%

    7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR…

  18. 8.1CVE-2026-8095EPSS 0.6%

    The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wp…

  19. 7.1CVE-2026-49413EPSS 0.1%

    The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrec…

  20. 6.5CVE-2026-45259EPSS 0.1%

    sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue did not include a capability mode check restricting signal delivery to the calling process's own PID.…

  21. 9.8CVE-2026-12415EPSS 0.8%

    The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax…

  22. 8.6CVE-2026-56414EPSS 0.4%

    A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This de…

  23. 8.4CVE-2026-33560EPSS 0.4%

    The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspec…

  24. 4.6CVE-2026-38571EPSS 0.2%

    Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug console of the Tenda N300 F3 (V603) allow a physically proximate attacker to obtain s…

  25. 8.2CVE-2026-55188EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replica…

  26. 8.2CVE-2026-52783EPSS 0.2%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key st…

  27. 7.5CVE-2026-48743EPSS 0.3%

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN …

  28. 5.5CVE-2026-45407EPSS 0.1%

    Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission set…

  29. 7.1CVE-2026-47214EPSS 0.4%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

  30. 9.1CVE-2026-57658EPSS 0.5%

    Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

  31. 9.9CVE-2026-56059EPSS 0.5%

    Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

  32. 9.9CVE-2026-56058EPSS 0.5%

    Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

  33. 9.8CVE-2026-56033EPSS 0.5%

    Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.

  34. 9.8CVE-2026-56030EPSS 0.5%

    Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.

  35. 9.8CVE-2026-56028EPSS 0.5%

    Unauthenticated Privilege Escalation in Easy Elements for Elementor &#8211; Addons &amp; Website Templates <= 1.4.9 versions.

  36. 9.9CVE-2026-56027EPSS 0.5%

    Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.

  37. 8.8CVE-2026-56010EPSS 0.4%

    Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

  38. 8.8CVE-2026-56008EPSS 0.4%

    Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.

  39. 5.5CVE-2026-45256EPSS 0.1%

    When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission…

  40. 3.5CVE-2026-3472EPSS 0.3%

    Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result posts, which allows an authenticated attacker to exfiltrate data to an attacker-…

  41. 7.5CVE-2026-57913EPSS 0.4%

    Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.

  42. 7.5CVE-2026-57912EPSS 0.4%

    Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers.

  43. 6.9CVE-2026-44622EPSS 0.4%

    Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

  44. 8.3CVE-2026-13281EPSS 0.3%

    Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

  45. 10.0CVE-2025-71338EPSS 1.2%

    Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storag…

  46. 9.3CVE-2025-71334ExploitEPSS 4.4%

    Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../..…

  47. 9.3CVE-2025-71333EPSS 0.9%

    Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upl…

  48. 8.7CVE-2025-71324ExploitEPSS 1.6%

    Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStora…

  49. 10.0CVE-2026-57700EPSS 0.5%

    Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.

  50. 7.4CVE-2026-46608EPSS 0.4%

    Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implement…