cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 22

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 9.8CVE-2026-73397EPSS 0.6%

    Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

  2. 9.8CVE-2026-73380EPSS 0.6%

    Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

  3. 9.8CVE-2026-73376EPSS 0.6%

    Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

  4. 7.2CVE-2026-73367EPSS 0.3%

    Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

  5. 9.8CVE-2026-73366EPSS 0.6%

    Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

  6. 9.8CVE-2026-73341EPSS 0.6%

    Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

  7. 7.2CVE-2026-66620EPSS 0.5%

    Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

  8. 9.8CVE-2026-59940EPSS 0.8%

    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general d…

  9. 9.8CVE-2026-32470EPSS 0.6%

    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

  10. 7.7CVE-2026-50575EPSS 0.2%

    BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Vers…

  11. 8.8CVE-2026-32465EPSS 0.5%

    Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

  12. 5.4CVE-2026-59781EPSS 0.2%

    When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its co…

  13. 5.4CVE-2026-71858EPSS 0.1%

    Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Ope…

  14. 7.8CVE-2026-50773EPSS 0.3%

    An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.

  15. 6.1CVE-2026-73851EPSS 2.3%

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.…

  16. 7.3CVE-2026-56090EPSS 0.2%

    Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

  17. 8.0CVE-2026-16138EPSS 0.8%

    In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller ho…

  18. 7.0CVE-2026-18674EPSS 0.6%

    On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. A…

  19. 9.3CVE-2026-74890EPSS 0.2%

    openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code executi…

  20. 8.7CVE-2026-74882EPSS 0.2%

    openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate heade…

  21. 9.3CVE-2026-74875EPSS 0.3%

    openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata for…

  22. 9.3CVE-2026-74872EPSS 0.7%

    openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .s…

  23. 9.8CVE-2024-13784EPSS 0.8%

    The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes i…

  24. 6.6CVE-2026-10035EPSS 0.7%

    The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached thr…

  25. 8.8CVE-2026-16099EPSS 1.1%

    The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for a…

  26. 6.1CVE-2025-7639EPSS 0.6%

    The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Ente…

  27. 6.5CVE-2026-73846EPSS 0.2%

    CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different …

  28. 7.1CVE-2026-49986EPSS 0.2%

    The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory …

  29. 7.5CVE-2026-53970EPSS 0.3%

    ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-ba…

  30. 8.4CVE-2026-19884EPSS 0.2%

    In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such …

  31. 6.5CVE-2026-58224EPSS 0.3%

    A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, o…

  32. 5.5CVE-2026-19826EPSS 0.6%

    A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deseria…

  33. 6.9CVE-2026-72817EPSS 0.2%

    go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted pr…

  34. 5.3CVE-2026-73840EPSS 0.3%

    OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provide…

  35. 4.2CVE-2026-73657EPSS 0.2%

    Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.fi…

  36. 4.3CVE-2026-72655EPSS 0.3%

    Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has…

  37. 8.8CVE-2026-16674EPSS 0.7%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.

  38. 7.8CVE-2026-14875EPSS 0.2%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.

  39. 5.3CVE-2026-10571EPSS 0.6%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources …

  40. 9.3CVE-2026-73533EPSS 0.6%

    Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableD…

  41. 9.3CVE-2026-73532EPSS 0.7%

    Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), lo…

  42. 7.2CVE-2026-66256EPSS 0.9%Unsupported when assigned

    Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the …

  43. 9.8CVE-2026-28185EPSS 0.3%

    Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

  44. 8.8CVE-2026-28176EPSS 0.5%

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

  45. 9.8CVE-2026-28149EPSS 0.6%

    Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

  46. 7.2CVE-2026-27380EPSS 0.5%

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

  47. 8.1CVE-2026-6464EPSS 0.4%

    Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indi…

  48. 8.8CVE-2026-18408EPSS 0.4%

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \rest…

  49. 3.8CVE-2026-14673EPSS 0.3%

    Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before …

  50. 6.5CVE-2026-14663EPSS 0.1%

    Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the applicati…