cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 17

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 8.7CVE-2024-58381EPSS 0.8%

    PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization fro…

  2. 9.8CVE-2026-80172EPSS 0.3%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could e…

  3. 7.4CVE-2026-79963EPSS 0.3%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentia…

  4. 5.3CVE-2026-83537EPSS 0.2%

    The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

  5. 4.8CVE-2026-21113EPSS 0.1%

    Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.

  6. 6.9CVE-2026-21108EPSS 0.1%

    Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information.

  7. 6.6CVE-2026-11363EPSS 0.9%

    The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for auth…

  8. 5.1CVE-2026-87083EPSS 0.3%

    A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to de…

  9. 8.1CVE-2026-87530EPSS 0.1%

    Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

  10. 7.0CVE-2026-81192EPSS 0.2%

    `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detect…

  11. 4.0CVE-2026-80159EPSS 0.2%

    Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyon…

  12. 6.3CVE-2026-78574EPSS 0.1%

    The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resu…

  13. 8.6CVE-2026-76199EPSS 0.3%

    Photoshop Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Ex…

  14. 8.6CVE-2026-79721EPSS 0.5%

    Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.

  15. 7.3CVE-2026-45528EPSS 0.09%

    In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User i…

  16. 8.8CVE-2026-81385EPSS 1.3%

    Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

  17. 8.8CVE-2026-77484EPSS 1.7%

    Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

  18. 5.5CVE-2026-72980EPSS 0.6%

    Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.

  19. 7.8CVE-2026-69785EPSS 0.5%

    Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.

  20. 7.0CVE-2026-69694EPSS 2.8%

    Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.

  21. 7.8CVE-2026-69328EPSS 0.5%

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

  22. 8.8CVE-2026-65772EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

  23. 8.1CVE-2026-47297EPSS 1.1%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  24. 9.8CVE-2026-12745EPSS 2.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

  25. 9.8CVE-2026-12744EPSS 2.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

  26. 8.8CVE-2026-12651EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  27. 8.8CVE-2026-12650EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  28. 8.8CVE-2026-12648EPSS 1.9%

    A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  29. 8.7CVE-2026-73316EPSS 0.3%

    XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers ca…

  30. 7.3CVE-2026-77092EPSS 0.3%

    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

  31. 8.8CVE-2026-16502EPSS 0.9%

    The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated at…

  32. 7.0CVE-2026-62654EPSS 0.2%

    A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network…

  33. 9.8CVE-2026-71374EPSS 0.6%

    Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 throu…

  34. 7.8CVE-2026-76967EPSS 0.4%

    SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted…

  35. 7.8CVE-2026-86504EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

  36. 9.8CVE-2026-7861EPSS 0.6%

    Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.

  37. 8.8CVE-2026-86404EPSS 0.7%

    EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() metho…

  38. 8.5CVE-2026-84226EPSS 0.1%

    OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps

  39. 5.5CVE-2026-20516EPSS 0.1%

    In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS1106…

  40. 9.8CVE-2026-10196EPSS 1.1%

    The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handl…

  41. 8.7CVE-2026-86169EPSS 0.9%

    Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python c…

  42. 8.8CVE-2026-19887EPSS 1.1%

    The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Un…

  43. 9.4CVE-2026-52777EPSS 0.3%

    YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

  44. 7.5CVE-2026-61686EPSS 0.4%

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writabl…

  45. 5.3CVE-2026-85008EPSS 0.1%

    undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is nev…

  46. 6.9CVE-2026-85621EPSS 0.2%

    LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each ada…

  47. 8.5CVE-2026-6958EPSS 0.2%

    Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a mis…

  48. 5.3CVE-2026-84043EPSS 0.2%

    The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signatur…

  49. 2.1CVE-2026-85408EPSS 0.4%

    A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdB…

  50. 9.3CVE-2026-85435EPSS 0.4%

    MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to r…