cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 34

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 8.1CVE-2026-39539EPSS 0.3%

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

  2. 9.8CVE-2026-39529EPSS 0.4%

    Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

  3. 8.1CVE-2026-39446EPSS 0.3%

    Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

  4. 8.1CVE-2026-39443EPSS 0.3%

    Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

  5. 9.8CVE-2026-27429EPSS 0.6%

    Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

  6. 6.5CVE-2026-27410EPSS 0.3%

    Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

  7. 8.8CVE-2026-12256EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.

  8. 6.6CVE-2026-12115EPSS 0.5%

    The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possibl…

  9. 8.4CVE-2026-11857EPSS 0.3%

    Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound t…

  10. 9.8CVE-2025-69122EPSS 0.5%

    Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

  11. 9.8CVE-2025-69108EPSS 0.5%

    Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

  12. 9.8CVE-2025-60205EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.

  13. 9.8CVE-2026-35300EPSS 0.6%

    Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticat…

  14. 7.2CVE-2026-53865EPSS 0.1%

    OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operat…

  15. 2.3CVE-2026-53862EPSS 0.09%

    OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing a…

  16. 7.0CVE-2026-53858EPSS 0.1%

    OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime …

  17. 7.0CVE-2026-53846EPSS 0.1%

    OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace …

  18. 7.0CVE-2026-53842EPSS 0.1%

    OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository ac…

  19. 6.8CVE-2026-48775EPSS 0.2%

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint…

  20. 8.6CVE-2026-10748EPSS 0.3%

    An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

  21. 8.6CVE-2026-42089EPSS 0.2%

    Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names wi…

  22. 7.8CVE-2026-24228EPSS 0.2%

    NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and in…

  23. 5.3CVE-2026-12003EPSS 0.1%

    To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is …

  24. 6.7CVE-2024-22451EPSS 0.10%

    Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code e…

  25. 7.8CVE-2024-22447EPSS 0.10%

    Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious dll., leading to arbitrary code execution.

  26. 4.3CVE-2026-53900EPSS 0.1%

    Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability…

  27. 6.5CVE-2026-53899EPSS 0.10%

    Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

  28. 9.2CVE-2026-48853EPSS 0.8%

    Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows …

  29. 8.5CVE-2026-5064EPSS 0.1%

    Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate t…

  30. 9.8CVE-2026-9691EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

  31. 9.8CVE-2026-49781EPSS 0.5%

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

  32. 9.8CVE-2026-49770EPSS 0.4%

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  33. 9.8CVE-2026-49769EPSS 0.3%

    Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

  34. 9.8CVE-2026-49768EPSS 0.4%

    Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

  35. 9.8CVE-2026-49765EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

  36. 9.8CVE-2026-49763EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

  37. 9.8CVE-2026-49109EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

  38. 9.8CVE-2026-49106EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

  39. 9.8CVE-2026-49105EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  40. 9.8CVE-2026-49104EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

  41. 9.8CVE-2026-49085EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  42. 8.5CVE-2026-48124EPSS 0.1%

    Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious worksp…

  43. 8.1CVE-2026-42687EPSS 0.3%

    Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  44. 8.8CVE-2026-39532EPSS 0.3%

    Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

  45. 7.2CVE-2026-39499EPSS 0.4%

    Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

  46. 7.2CVE-2026-39498EPSS 0.4%

    Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

  47. 7.2CVE-2026-39481EPSS 0.4%

    Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

  48. 8.8CVE-2026-39478EPSS 0.4%

    Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

  49. 8.8CVE-2026-39474EPSS 0.4%

    Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

  50. 7.2CVE-2026-39472EPSS 0.4%

    Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.