cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 25

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 9.8CVE-2026-65578EPSS 0.6%

    Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

  2. 9.8CVE-2026-65577EPSS 0.6%

    Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

  3. 9.8CVE-2026-65576EPSS 0.6%

    Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

  4. 9.8CVE-2026-65575EPSS 0.6%

    Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

  5. 9.8CVE-2026-65574EPSS 0.6%

    Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

  6. 9.8CVE-2026-65573EPSS 0.6%

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

  7. 9.8CVE-2026-65572EPSS 0.6%

    Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

  8. 9.8CVE-2026-65571EPSS 0.6%

    Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

  9. 9.8CVE-2026-65556EPSS 0.6%

    Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

  10. 9.8CVE-2026-65552EPSS 0.6%

    Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

  11. 7.2CVE-2026-65549EPSS 0.5%

    Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

  12. 9.8CVE-2026-28139EPSS 0.6%

    Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  13. 4.3CVE-2026-15246EPSS 0.1%

    The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user su…

  14. 9.1CVE-2026-65583EPSS 0.3%

    Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, no…

  15. 9.1CVE-2026-63687EPSS 0.3%

    Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose cli…

  16. 9.8CVE-2026-66909EPSS 1.1%

    Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a mal…

  17. 8.3CVE-2026-17583EPSS 0.1%

    The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

  18. 7.8CVE-2026-55522EPSS 0.2%

    PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly…

  19. 9.0CVE-2026-70426EPSS 0.5%

    In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting des…

  20. 6.5CVE-2026-49331EPSS 0.2%

    A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream …

  21. 8.6CVE-2026-67623EPSS 1.1%

    Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe inv…

  22. 7.6CVE-2026-71294EPSS 0.4%

    Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is pas…

  23. 8.8CVE-2026-71281EPSS 0.5%

    Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=…

  24. 9.3CVE-2026-66747EPSS 0.8%

    Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boo…

  25. 9.8CVE-2026-61484EPSS 0.8%Unsupported when assigned

    Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alt…

  26. 5.4CVE-2026-66344EPSS 0.2%

    NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileg…

  27. 9.3CVE-2026-70554EPSS 1.2%

    MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without valida…

  28. 9.8CVE-2026-66902EPSS 0.7%

    Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as …

  29. 8.5CVE-2026-18657EPSS 0.2%

    An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses worksp…

  30. 8.5CVE-2026-18656EPSS 0.2%

    An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses works…

  31. 8.4CVE-2026-47781EPSS 0.2%

    PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted…

  32. 8.2CVE-2026-47623EPSS 0.7%

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.

  33. 8.8CVE-2026-69258EPSS 0.7%

    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal…

  34. 9.3CVE-2026-69098EPSS 0.9%

    kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ …

  35. 7.1CVE-2026-67618EPSS 0.3%

    marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configura…

  36. 1.8CVE-2026-11836EPSS 0.1%

    Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production de…

  37. 9.3CVE-2026-48063EPSS 0.2%

    Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event w…

  38. 8.5CVE-2026-41447EPSS 0.2%

    FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory p…

  39. 8.4CVE-2026-47211EPSS 0.2%

    Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands wi…

  40. 8.8CVE-2026-68945EPSS 0.2%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing …

  41. 7.1CVE-2026-18718EPSS 0.2%

    Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim…

  42. 6.4CVE-2026-18605EPSS 0.2%

    A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path.…

  43. 1.9CVE-2026-18604EPSS 0.1%

    A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application co…

  44. 9.1CVE-2026-18248EPSS 0.4%

    @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer …

  45. 7.8CVE-2026-18642EPSS 0.4%

    Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.

  46. 7.3CVE-2026-0392EPSS 0.09%

    eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS bu…

  47. 6.5CVE-2026-12259EPSS 0.1%

    In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with t…

  48. 8.4CVE-2026-9593EPSS 0.2%

    A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to…

  49. 4.1CVE-2026-16297EPSS 0.4%

    The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code…

  50. 8.1CVE-2025-15672EPSS 0.6%

    The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code exec…