cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 12

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 8.1CVE-2026-102101EPSS 0.9%

    Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in …

  2. 8.8CVE-2026-97291EPSS 0.3%

    Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.

  3. 7.2CVE-2026-97256EPSS 0.3%

    Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

  4. 7.2CVE-2026-102392EPSS 0.3%

    Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.

  5. 8.8CVE-2026-102377EPSS 0.3%

    Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

  6. 9.8CVE-2026-100512EPSS 0.3%

    Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

  7. 5.9CVE-2026-55174EPSS 0.1%

    UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verif…

  8. 7.8CVE-2026-47570EPSS 0.1%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code executio…

  9. 7.2CVE-2026-103441EPSS 0.3%

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

  10. 6.5CVE-2026-100265EPSS 0.1%

    In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

  11. 7.8CVE-2026-100256EPSS 0.1%

    In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

  12. 9.3CVE-2026-103395EPSS 0.6%

    LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and p…

  13. 9.8CVE-2026-97248EPSS 0.4%

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

  14. 4.9CVE-2026-97246EPSS 0.2%

    Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

  15. 7.2CVE-2026-96833EPSS 0.4%

    Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

  16. 7.2CVE-2026-96832EPSS 0.4%

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

  17. 8.8CVE-2026-96831EPSS 0.3%

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

  18. 7.2CVE-2026-96344EPSS 0.4%

    Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

  19. 7.2CVE-2026-96343EPSS 0.4%

    Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

  20. 8.8CVE-2026-95531EPSS 0.5%

    Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

  21. 8.8CVE-2026-94683EPSS 0.3%

    Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

  22. 8.8CVE-2026-94678EPSS 0.4%

    Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

  23. 7.2CVE-2026-94677EPSS 0.4%

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

  24. 7.2CVE-2026-94122EPSS 0.4%

    Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

  25. 8.8CVE-2026-94121EPSS 0.4%

    Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

  26. 8.8CVE-2026-94076EPSS 0.3%

    Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

  27. 7.2CVE-2026-93771EPSS 0.4%

    Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

  28. 7.2CVE-2026-93651EPSS 0.4%

    Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

  29. 7.2CVE-2026-93624EPSS 0.4%

    Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

  30. 9.1CVE-2026-89238EPSS 0.3%

    WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.…

  31. 5.4CVE-2026-13720EPSS 0.2%

    An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authori…

  32. 8.7CVE-2026-103235EPSS 0.3%

    MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persis…

  33. 9.3CVE-2026-102455EPSS 0.5%

    EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

  34. 8.6CVE-2026-97150EPSS 0.3%

    When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administra…

  35. 6.6CVE-2026-91051EPSS 0.3%

    The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to…

  36. 9.2CVE-2026-86131EPSS 0.5%

    A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.

  37. 7.5CVE-2026-13046EPSS 0.4%

    A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in…

  38. 9.3CVE-2026-103041EPSS 0.8%

    LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary c…

  39. 9.3CVE-2026-103040EPSS 1.0%

    LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowin…

  40. 7.7CVE-2026-102930EPSS 0.2%

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an…

  41. 8.1CVE-2026-102831EPSS 0.2%

    JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 …

  42. 6.9CVE-2026-102711EPSS 0.08%

    In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image…

  43. 8.8CVE-2026-102677EPSS 0.10%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matche…

  44. 8.4CVE-2026-100308EPSS 0.1%

    Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafte…

  45. 9.8CVE-2026-73595EPSS 0.1%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exp…

  46. 7.0CVE-2026-19547EPSS 0.1%

    Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default…

  47. 8.7CVE-2026-101169EPSS 0.3%

    In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute …

  48. 2.1CVE-2026-101278EPSS 0.1%

    A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libopendmarc/opendmarc_tld.c : of the component PSL Wildcard Handler. Executing a manipulation can lead…

  49. 8.2CVE-2026-102275EPSS 0.2%

    PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. Thi…

  50. 9.1CVE-2026-102267EPSS 0.2%

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endp…