cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 18

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 9.3CVE-2026-85434EPSS 0.4%

    MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-c…

  2. 8.7CVE-2026-85431EPSS 3.4%

    MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary vari…

  3. 8.8CVE-2026-85430EPSS 1.7%

    MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagram…

  4. 8.7CVE-2026-85429EPSS 0.4%

    MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other …

  5. 9.2CVE-2026-85427EPSS 0.6%

    MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish…

  6. 7.1CVE-2026-53728EPSS 0.2%

    Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a reg…

  7. 6.2CVE-2026-19795EPSS 0.3%

    Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing …

  8. 9.8CVE-2026-84834EPSS 0.6%

    Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

  9. 5.3CVE-2026-84767EPSS 0.2%

    Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

  10. 9.8CVE-2026-84753EPSS 0.6%

    Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

  11. 8.8CVE-2026-84752EPSS 0.5%

    Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.

  12. 6.8CVE-2026-82525EPSS 0.2%

    Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XS…

  13. 9.3CVE-2026-85181EPSS 0.7%

    CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and…

  14. 8.6CVE-2026-84832EPSS 0.6%

    SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privil…

  15. 7.7CVE-2023-20576EPSS 0.1%

    Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.

  16. 5.9CVE-2026-20355EPSS 0.2%

    Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. Th…

  17. 8.8CVE-2026-84670EPSS 0.6%

    Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers wi…

  18. 5.4CVE-2026-84666EPSS 0.1%

    Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified…

  19. 5.4CVE-2026-84664EPSS 0.1%

    Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by a…

  20. 8.8CVE-2026-84650EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, t…

  21. 8.8CVE-2026-84647EPSS 0.5%

    In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to t…

  22. 4.3CVE-2026-84646EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

  23. 8.8CVE-2026-84645EPSS 0.8%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins (such as the global configuration and jobs) can appear as nested field va…

  24. 5.3CVE-2026-83533EPSS 0.2%

    The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

  25. 3.3CVE-2023-3360EPSS 0.2%

    The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on…

  26. 8.8CVE-2026-81772EPSS 0.5%

    Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.

  27. 8.8CVE-2026-81283EPSS 0.5%

    Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

  28. 8.1CVE-2026-19219EPSS 0.2%

    In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to…

  29. 4.3CVE-2026-79621EPSS 0.1%

    The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated a…

  30. 8.8CVE-2026-19116EPSS 0.7%

    The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access…

  31. 2.1CVE-2026-84430EPSS 0.4%

    A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument p…

  32. 8.7CVE-2026-71981EPSS 1.0%

    Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout hand…

  33. 8.8CVE-2026-72649EPSS 0.9%

    Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logi…

  34. 8.5CVE-2026-45221EPSS 0.2%

    Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path abs…

  35. 7.3CVE-2026-19590EPSS 0.2%

    OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved …

  36. 8.7CVE-2026-84202EPSS 0.7%

    ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files t…

  37. 7.8CVE-2026-61779EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  38. 7.8CVE-2026-61778EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  39. 7.8CVE-2026-61777EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  40. 7.8CVE-2026-61776EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  41. 7.8CVE-2026-61775EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  42. 7.8CVE-2026-61774EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  43. 7.8CVE-2026-61773EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  44. 7.8CVE-2026-61772EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  45. 7.8CVE-2026-61771EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  46. 7.8CVE-2026-61770EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  47. 7.8CVE-2026-61769EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  48. 7.8CVE-2026-61768EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  49. 7.8CVE-2026-61767EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  50. 7.8CVE-2026-61766EPSS 0.4%

    NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.