OWASP A06:2025 Insecure Design vulnerabilities, newest first, page 9
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A06:2025 at MITRE.
Its weaknesses: 39
CWE-73, CWE-183, CWE-256, CWE-266, CWE-269, CWE-286, CWE-311, CWE-312, CWE-313, CWE-316, CWE-362, CWE-382, CWE-419, CWE-434, CWE-436, CWE-444, CWE-451, CWE-454, CWE-472, CWE-501, CWE-522, CWE-525, CWE-539, CWE-598, CWE-602, CWE-628, CWE-642, CWE-646, CWE-653, CWE-656, CWE-657, CWE-676, CWE-693, CWE-799, CWE-807, CWE-841, CWE-1021, CWE-1022, CWE-1125
- 6.7CVE-2026-114223EPSS 0.08%
NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization…
- 5.9CVE-2026-114221EPSS 0.3%
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, th…
- 3.1CVE-2026-96369EPSS 0.2%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3…
- 5.3CVE-2026-96364EPSS 0.3%
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- 5.4CVE-2026-87940EPSS 0.2%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
- 8.7CVE-2026-114658EPSS 0.3%
Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in pag…
- 6.9CVE-2026-114656EPSS 0.2%
Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backen…
- 6.3CVE-2026-114641EPSS 0.3%
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote a…
- 7.5CVE-2026-112212EPSS 0.2%
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OI…
- 9.8CVE-2026-76528EPSS 0.4%
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…
- 9.8CVE-2026-76301EPSS 0.4%
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…
- 8.8CVE-2026-103090EPSS 0.5%
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Googl…
- 5.3CVE-2026-114379EPSS 0.3%
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manip…
- 9.1CVE-2026-114139EPSS 0.5%
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute,…
- 6.9CVE-2026-111809EPSS 0.2%
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,…
- 7.0CVE-2026-78118EPSS 0.1%
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutati…
- 4.2CVE-2026-78117EPSS 0.2%
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared and …
- 6.3CVE-2026-114361EPSS 0.4%
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in im…
- 9.2CVE-2026-111816EPSS 0.3%
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then …
- 7.0CVE-2025-55702EPSS 0.3%
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that …
- 9.1CVE-2025-31699EPSS 0.3%
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then rea…
- 6.9CVE-2026-114491EPSS 0.3%
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href …
- 5.5CVE-2026-114262EPSS 0.4%
A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestrict…
- 6.5CVE-2026-114131EPSS 0.4%
Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-en…
- 8.6CVE-2026-114125EPSS 0.4%
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook developme…
- 7.2CVE-2026-110744EPSS 0.4%
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts w…
- 7.8CVE-2026-20291EPSS 0.2%
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardeni…
- 5.5CVE-2026-114259EPSS 0.3%
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unr…
- 2.1CVE-2026-114253EPSS 0.3%
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can le…
- 2.3CVE-2026-113786EPSS 0.4%
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the imag…
- 9.9CVE-2026-111834EPSS 0.4%
Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.
- 10.0CVE-2026-111832EPSS 0.4%
Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.
- 5.5CVE-2026-114249EPSS 0.3%
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHol…
- 8.1CVE-2026-94300EPSS 1.0%
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries t…
- 7.5CVE-2026-86147EPSS 0.5%
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite file…
- 7.5CVE-2026-86146EPSS 0.5%
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is de…
- 7.5CVE-2026-84747EPSS 0.5%
Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function Find…
- 7.5CVE-2026-82942EPSS 0.4%
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA wit…
- 5.1CVE-2026-114398EPSS 0.3%
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spo…
- 5.5CVE-2026-114245EPSS 0.4%
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/…
- 6.5CVE-2026-50106EPSS 0.2%
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious act…
- 8.1CVE-2026-110523EPSS 0.4%
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured …
- 7.5CVE-2026-107506EPSS 0.3%
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users…
- 6.0CVE-2026-114116EPSS 0.3%
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and …
- 8.2CVE-2026-114104EPSS 0.3%
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the…
- 9.2CVE-2026-114087EPSS 0.5%
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unaut…
- 5.1CVE-2026-114070EPSS 0.3%
Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public sessio…
- 8.6CVE-2026-114069EPSS 0.4%
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview env…
- 5.3CVE-2026-113707EPSS 0.3%
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack …
- 8.8CVE-2026-91668EPSS 0.3%
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privilege…