cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 23

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 5.9CVE-2026-0299EPSS 0.2%

    Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user…

  2. 6.0CVE-2026-0294EPSS 0.2%

    A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and …

  3. 8.5CVE-2026-71473EPSS 0.5%

    A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can overrid…

  4. 9.0CVE-2026-71471EPSS 1.2%

    A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field…

  5. 6.8CVE-2026-73419EPSS 0.2%

    NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to …

  6. 9.6CVE-2026-13433EPSS 0.2%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's wo…

  7. 7.5CVE-2026-67579EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the da…

  8. 9.9CVE-2026-16860EPSS 0.7%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

  9. 8.3CVE-2026-17095EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.

  10. 8.4CVE-2026-73325EPSS 0.4%

    Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized…

  11. 8.1CVE-2026-69105EPSS 0.2%

    An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

  12. 8.8CVE-2026-67587EPSS 0.6%

    Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `…

  13. 7.3CVE-2026-67260EPSS 0.8%

    Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who contr…

  14. 5.4CVE-2026-59242EPSS 0.5%

    Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user w…

  15. 8.8CVE-2026-58076EPSS 0.5%

    Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imp…

  16. 6.6CVE-2026-68756EPSS 0.5%

    A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

  17. 8.4CVE-2025-59323EPSS 0.1%

    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details. Crafted DataStore contents can impact s…

  18. 3.7CVE-2026-18044EPSS 0.1%

    The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary …

  19. 8.4CVE-2026-18634EPSS 0.3%

    An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this…

  20. 8.6CVE-2026-48397EPSS 1.0%

    Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Ex…

  21. 7.0CVE-2025-54512EPSS 0.2%

    A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution.

  22. 8.8CVE-2026-70321EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  23. 8.8CVE-2026-66808EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  24. 8.8CVE-2026-66805EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  25. 8.8CVE-2026-65815EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

  26. 8.8CVE-2026-65665EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  27. 8.8CVE-2026-65663EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  28. 8.8CVE-2026-65658EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  29. 8.8CVE-2026-64901EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  30. 6.5CVE-2026-63516EPSS 1.9%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  31. 8.8CVE-2026-63514EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  32. 6.5CVE-2026-62912EPSS 2.0%

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

  33. 6.5CVE-2026-62902EPSS 0.9%

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

  34. 8.8CVE-2026-62869EPSS 0.4%

    Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

  35. 9.8CVE-2026-59124EPSS 1.5%

    Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

  36. 7.8CVE-2026-56174EPSS 0.5%

    Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

  37. 7.8CVE-2026-54981EPSS 0.5%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

  38. 4.6CVE-2026-35502EPSS 0.3%

    Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined wit…

  39. 5.4CVE-2026-34175EPSS 0.2%

    Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined wit…

  40. 5.4CVE-2026-32791EPSS 0.1%

    Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user …

  41. 5.4CVE-2026-32788EPSS 0.2%

    Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user comb…

  42. 5.4CVE-2026-28700EPSS 0.2%

    Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may ena…

  43. 5.4CVE-2026-20799EPSS 0.1%

    Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a hig…

  44. 7.0CVE-2025-8087EPSS 0.2%

    A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution.

  45. 4.6CVE-2025-48506EPSS 0.2%

    Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution.

  46. 5.7CVE-2025-31356EPSS 0.07%

    Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure. A system software adversary with a privileged user access combined with …

  47. 4.6CVE-2025-0041EPSS 0.2%

    Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.

  48. 8.4CVE-2026-73076EPSS 0.1%

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimbal…

  49. 10.0CVE-2026-17061EPSS 0.8%

    A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.

  50. 9.3CVE-2026-48046EPSS 0.4%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process dow…