cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 2

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 5.3CVE-2026-61803EPSS 0.2%

    Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to com…

  2. 9.3CVE-2026-119706EPSS 1.0%

    InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-e…

  3. 7.1CVE-2026-119289EPSS 0.2%

    Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list a…

  4. 9.4CVE-2026-93327EPSS 0.4%

    A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a mali…

  5. 7.5CVE-2026-45145EPSS 0.4%

    Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database …

  6. 5.3CVE-2026-119565EPSS 0.3%

    Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffi…

  7. 8.2CVE-2026-119422EPSS 0.2%

    Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without e…

  8. 9.8CVE-2026-103039EPSS 0.5%

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted val…

  9. 7.5CVE-2026-114422EPSS 0.5%

    The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that i…

  10. –CVE-2026-118562EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

  11. –CVE-2026-114573EPSS 0.2%

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

  12. 9.8CVE-2026-107249EPSS 0.4%

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

  13. 8.7CVE-2026-107238EPSS 0.4%

    A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

  14. 9.3CVE-2023-22793EPSS 0.5%

    A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

  15. 7.4CVE-2026-92092EPSS 0.2%

    A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or…

  16. 9.3CVE-2026-118762EPSS 0.3%

    Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependen…

  17. 7.5CVE-2026-107059EPSS 0.3%

    An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.

  18. 9.8CVE-2026-107057EPSS 0.4%

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

  19. 7.5CVE-2026-107051EPSS 0.2%

    Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.

  20. 9.8CVE-2026-107048EPSS 0.5%

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

  21. 5.3CVE-2026-107046EPSS 0.3%

    A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.

  22. 9.1CVE-2026-107043EPSS 0.3%

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

  23. 8.6CVE-2023-7357EPSS 0.4%

    A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.

  24. 9.1CVE-2026-90863EPSS 0.7%

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling a…

  25. 9.8CVE-2026-62131EPSS 0.3%

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

  26. 9.8CVE-2026-62018EPSS 0.4%

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  27. 9.8CVE-2026-62017EPSS 0.4%

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  28. 9.8CVE-2026-62016EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

  29. 9.8CVE-2026-62015EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

  30. 9.8CVE-2026-62014EPSS 0.4%

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

  31. 9.8CVE-2026-62013EPSS 0.4%

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

  32. 9.8CVE-2026-62012EPSS 0.4%

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

  33. 9.8CVE-2026-62011EPSS 0.4%

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

  34. 9.8CVE-2026-62010EPSS 0.4%

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

  35. 9.8CVE-2026-62009EPSS 0.4%

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

  36. 9.8CVE-2026-62008EPSS 0.4%

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

  37. 9.8CVE-2026-62006EPSS 0.4%

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

  38. 9.8CVE-2026-62005EPSS 0.4%

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

  39. 9.8CVE-2026-62004EPSS 0.4%

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

  40. 9.8CVE-2026-62003EPSS 0.4%

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

  41. 9.8CVE-2026-62002EPSS 0.5%

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

  42. 9.8CVE-2026-62001EPSS 0.5%

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

  43. 9.8CVE-2026-61998EPSS 0.5%

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

  44. 9.8CVE-2026-61997EPSS 0.5%

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

  45. 9.8CVE-2026-61992EPSS 0.4%

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

  46. 9.8CVE-2026-54860EPSS 0.5%

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

  47. 9.8CVE-2026-54859EPSS 0.5%

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

  48. 9.8CVE-2026-54858EPSS 0.5%

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

  49. 9.8CVE-2026-54857EPSS 0.5%

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

  50. 9.8CVE-2026-54856EPSS 0.5%

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.