cve.bz

OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 88

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.

Its weaknesses: 39

CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125

  1. 7.6CVE-2026-53853EPSS 0.3%

    OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured ar…

  2. 5.3CVE-2026-53847EPSS 0.2%

    OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. At…

  3. 2.3CVE-2026-53845EPSS 0.2%

    OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can exploit this by sending skill commands through the vulnerable d…

  4. 6.0CVE-2026-53840EPSS 0.2%

    OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint…

  5. 7.4CVE-2024-39575EPSS 0.10%

    update_disk_psu_baseline.sh requires password in plain text

  6. 7.0CVE-2024-38487EPSS 0.08%

    api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

  7. 9.2CVE-2025-13036EPSS 0.3%

    An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker may obtain a valid authentication token.

  8. 5.4CVE-2026-12323EPSS 0.2%

    Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  9. 5.4CVE-2026-12322EPSS 0.2%

    Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  10. 9.1CVE-2026-12316EPSS 0.2%

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  11. 9.1CVE-2026-12315EPSS 0.3%

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

  12. 4.7CVE-2026-12313EPSS 0.2%

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

  13. 6.5CVE-2026-12302EPSS 0.2%

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  14. 9.6CVE-2026-12297EPSS 0.4%

    Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  15. 9.6CVE-2026-12296EPSS 0.4%

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

  16. 9.6CVE-2026-12295EPSS 0.4%

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  17. 9.6CVE-2026-12294EPSS 0.4%

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  18. 8.8CVE-2026-12289EPSS 0.4%

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

  19. 9.9CVE-2026-40750EPSS 0.3%

    Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.

  20. 7.5CVE-2026-8176EPSS 0.5%

    The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that togethe…

  21. 6.3CVE-2025-9912EPSS 0.1%

    Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.

  22. 8.8CVE-2026-6933EPSS 0.8%

    The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before p…

  23. 8.8CVE-2026-49780EPSS 0.3%

    Customer Privilege Escalation in Dokan <= 5.0.2 versions.

  24. 7.5CVE-2026-49083EPSS 0.3%

    Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

  25. 7.3CVE-2026-49063EPSS 0.2%

    Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.

  26. 8.8CVE-2026-48889EPSS 0.4%

    Subscriber Privilege Escalation in Amelia <= 2.3 versions.

  27. 7.5CVE-2026-48708EPSS 0.4%

    OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates…

  28. 5.9CVE-2026-42655EPSS 0.2%

    Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.

  29. 10.0CVE-2026-40772EPSS 0.4%

    Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

  30. 9.9CVE-2026-39591EPSS 0.5%

    Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

  31. 8.1CVE-2026-39587EPSS 0.3%

    Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

  32. 9.8CVE-2026-39583EPSS 0.4%

    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

  33. 8.8CVE-2026-39579EPSS 0.3%

    Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

  34. 5.4CVE-2026-39527EPSS 0.3%

    Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.

  35. 7.2CVE-2026-39470EPSS 0.4%

    Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.

  36. 9.8CVE-2026-34901EPSS 0.3%

    Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

  37. 7.2CVE-2026-27407EPSS 0.4%

    Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

  38. 9.8CVE-2026-50873EPSS 0.4%

    An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.

  39. 8.4CVE-2026-39118EPSS 0.1%

    An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.

  40. 9.8CVE-2026-39006EPSS 0.5%

    An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

  41. 7.8CVE-2026-36213ExploitEPSS 0.6%

    An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

  42. 7.7CVE-2026-6517EPSS 0.2%

    Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to interc…

  43. 7.1CVE-2026-5233EPSS 0.2%

    Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

  44. 8.8CVE-2026-49111EPSS 0.2%

    Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.

  45. 9.3CVE-2018-25436EPSS 0.7%

    WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submi…

  46. 9.3CVE-2026-5482EPSS 0.4%

    Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.  This project is unmaintained at the time of CVE assign…

  47. 6.9CVE-2026-34030EPSS 0.3%

    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path …

  48. 5.3CVE-2026-34027EPSS 0.3%

    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-…

  49. 7.1CVE-2026-12217EPSS 0.1%

    A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An atta…

  50. 7.1CVE-2026-12214EPSS 0.1%

    A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring Logic. Performing a manipulation of the argument NetworkAddr r…