cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 3

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.2CVE-2026-42701EPSS 0.4%

    Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

  2. 9.1CVE-2026-119128EPSS 0.3%

    ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid veri…

  3. 7.7CVE-2026-119120EPSS 0.4%

    Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malic…

  4. 8.8CVE-2026-118081EPSS 0.4%

    Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

  5. 8.8CVE-2026-118080EPSS 0.4%

    Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

  6. 7.2CVE-2026-118079EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

  7. 7.2CVE-2026-118078EPSS 0.3%

    Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

  8. 7.2CVE-2026-118077EPSS 0.3%

    Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

  9. 8.8CVE-2026-118076EPSS 0.4%

    Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

  10. 8.8CVE-2026-118075EPSS 0.4%

    Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

  11. 7.2CVE-2026-118074EPSS 0.3%

    Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

  12. 8.8CVE-2026-118073EPSS 0.4%

    Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

  13. 7.2CVE-2026-116869EPSS 0.3%

    Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

  14. 8.8CVE-2026-116868EPSS 0.4%

    Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

  15. 8.8CVE-2026-116867EPSS 0.4%

    Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

  16. 8.8CVE-2026-116866EPSS 0.3%

    Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

  17. 7.2CVE-2026-116865EPSS 0.3%

    Editor PHP Object Injection in Zippy <= 1.7.0 versions.

  18. 7.2CVE-2026-116864EPSS 0.3%

    Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

  19. 7.5CVE-2026-107041EPSS 0.4%

    Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).

  20. 9.1CVE-2026-107040EPSS 0.3%

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  21. 9.1CVE-2026-107038EPSS 0.4%

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

  22. 5.1CVE-2026-107036EPSS 0.1%

    Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.

  23. 6.5CVE-2026-107033EPSS 0.2%

    Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.

  24. 9.1CVE-2026-107032EPSS 0.5%

    Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  25. 7.5CVE-2026-107030EPSS 0.3%

    Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.

  26. 9.1CVE-2026-107027EPSS 0.3%

    Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

  27. 7.5CVE-2026-107025EPSS 0.3%

    Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

  28. 8.8CVE-2026-104324EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

  29. 9.8CVE-2026-104317EPSS 0.6%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

  30. 9.1CVE-2026-107021EPSS 0.3%

    Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

  31. 8.8CVE-2026-107019EPSS 0.3%

    Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

  32. 9.1CVE-2026-107014EPSS 0.3%

    Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

  33. 6.8CVE-2026-93008EPSS 0.1%

    A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that…

  34. 8.4CVE-2026-103665EPSS 0.2%

    The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may…

  35. 7.4CVE-2026-15564EPSS 0.1%

    Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if th…

  36. 7.4CVE-2026-114488EPSS 0.3%

    A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authen…

  37. 9.0CVE-2026-103693EPSS 0.5%

    The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is v…

  38. 5.6CVE-2026-113957EPSS 0.1%

    An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the retu…

  39. 5.1CVE-2026-118538EPSS 0.3%

    A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determine…

  40. 6.5CVE-2026-118661EPSS 0.3%

    Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. I…

  41. 8.1CVE-2026-84725EPSS 0.3%

    when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in t…

  42. 7.8CVE-2026-118617EPSS 0.3%

    Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is r…

  43. 7.8CVE-2026-118613EPSS 0.2%

    Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to ex…

  44. 8.8CVE-2026-117624EPSS 0.4%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowin…

  45. 5.4CVE-2026-117613EPSS 0.3%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.…

  46. 8.8CVE-2026-117612EPSS 0.4%

    Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

  47. –CVE-2026-110985EPSS 0.1%

    A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifi…

  48. –CVE-2026-110952EPSS 0.1%

    A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is v…

  49. 8.8CVE-2026-103402EPSS 0.2%

    An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and es…

  50. 7.8CVE-2026-59176EPSS 0.2%

    Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp…