cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 31

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.8CVE-2026-24247EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  2. 7.8CVE-2026-24245EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  3. 7.8CVE-2026-24244EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  4. 7.8CVE-2026-24243EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  5. 7.8CVE-2026-24240EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  6. 8.9CVE-2026-10538EPSS 0.4%

    Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentiall…

  7. 9.3CVE-2026-56700EPSS 2.5%

    Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowe…

  8. 6.3CVE-2026-55223EPSS 0.5%

    c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSour…

  9. 7.8CVE-2026-54672EPSS 0.2%

    electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes th…

  10. 7.6CVE-2025-71374EPSS 0.7%

    picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass pickl…

  11. 7.6CVE-2025-71371EPSS 0.6%

    picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pi…

  12. 7.6CVE-2025-71368EPSS 0.8%

    picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls th…

  13. 7.6CVE-2025-71363EPSS 0.7%

    picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklesca…

  14. 7.6CVE-2025-71350EPSS 0.4%

    picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

  15. 7.6CVE-2025-71349EPSS 0.6%

    picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in t…

  16. 9.8CVE-2026-7871EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.

  17. 8.8CVE-2026-13759EPSS 0.5%

    IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on …

  18. 9.3CVE-2026-58116EPSS 0.9%

    LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application pas…

  19. 8.4CVE-2026-12578EPSS 0.4%

    The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.

  20. 8.0CVE-2026-12240EPSS 0.6%

    The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated a…

  21. 7.8CVE-2026-57919EPSS 0.2%

    PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker c…

  22. 9.6CVE-2026-13751EPSS 0.2%

    Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime wi…

  23. 1.3CVE-2026-13513EPSS 0.2%

    A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId::getCacheKey in the library src/VectorIndex/Common/SegmentId.h. The manipulation results in insufficient verification o…

  24. 2.3CVE-2026-13507EPSS 0.2%

    A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manip…

  25. 1.3CVE-2026-13483EPSS 0.1%

    A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of the component Credential Storage. This manipulation causes insufficient verific…

  26. 5.3CVE-2026-9242EPSS 0.3%

    The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and includin…

  27. 9.6CVE-2026-54351EPSS 0.5%

    Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in e…

  28. 7.5CVE-2026-46710EPSS 0.2%

    Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an abso…

  29. 9.9CVE-2026-46386EPSS 0.5%

    OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :mar…

  30. 8.7CVE-2026-57527EPSS 0.7%

    Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java…

  31. 9.8CVE-2026-56057EPSS 0.6%

    Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

  32. 8.8CVE-2026-56055EPSS 0.5%

    Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

  33. 9.8CVE-2026-56032EPSS 0.6%

    Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

  34. 8.1CVE-2026-56031EPSS 0.4%

    Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.

  35. 9.8CVE-2026-53914EPSS 0.3%

    In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

  36. 7.6CVE-2025-71340EPSS 0.4%

    picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the f…

  37. 7.7CVE-2021-47987EPSS 0.2%

    Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were publishe…

  38. 7.7CVE-2021-47986EPSS 0.2%

    Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in …

  39. 7.8CVE-2026-46607EPSS 0.2%

    Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db …

  40. 8.8CVE-2026-55698EPSS 0.3%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDep…

  41. 8.8CVE-2026-55697EPSS 0.2%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependen…

  42. 8.8CVE-2026-55487EPSS 0.2%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a…

  43. 8.1CVE-2026-50573EPSS 0.2%

    pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a pac…

  44. 4.8CVE-2026-48995EPSS 0.2%

    pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencie…

  45. 6.5CVE-2026-48943EPSS 0.3%

    K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `not…

  46. 8.8CVE-2026-56053EPSS 0.5%

    Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

  47. 7.8CVE-2026-10043EPSS 0.5%

    MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to e…

  48. 7.1CVE-2026-52812EPSS 0.2%

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpl…

  49. 8.5CVE-2026-45687EPSS 0.3%

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file ob…

  50. 9.3CVE-2026-56121EPSS 1.4%

    Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function…