cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 35

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.2CVE-2026-39471EPSS 0.4%

    Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

  2. 7.2CVE-2026-39434EPSS 0.4%

    Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

  3. 8.1CVE-2026-27333EPSS 0.3%

    Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.

  4. 9.8CVE-2026-27053EPSS 0.4%

    Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

  5. 9.8CVE-2026-39006EPSS 0.5%

    An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

  6. 8.0CVE-2025-68713EPSS 0.3%

    An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's s…

  7. 7.5CVE-2026-47777EPSS 0.2%

    Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the chec…

  8. 7.8CVE-2026-12057EPSS 0.1%

    When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

  9. 8.5CVE-2026-50100EPSS 0.1%

    Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer …

  10. 7.5CVE-2026-11860EPSS 0.2%

    Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization …

  11. 7.1CVE-2026-12191EPSS 0.1%

    A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack i…

  12. 5.0CVE-2026-54055EPSS 0.07%

    Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files o…

  13. 7.8CVE-2026-53406EPSS 0.08%

    Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

  14. 10.0CVE-2026-47691EPSS 0.4%

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cach…

  15. 10.0CVE-2026-45674EPSS 0.3%

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS response…

  16. 8.5CVE-2026-11967EPSS 0.1%

    MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the w…

  17. 8.5CVE-2026-11879EPSS 0.1%

    MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory that is predictable and can be modified by the user. During startup, the applicat…

  18. 8.1CVE-2026-50633EPSS 0.9%

    A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Us…

  19. 8.1CVE-2026-50632EPSS 0.7%

    A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS …

  20. 8.7CVE-2026-53819EPSS 0.3%

    OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute…

  21. 7.3CVE-2026-53813EPSS 0.1%

    OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts f…

  22. 7.7CVE-2026-53810EPSS 0.4%

    OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata…

  23. 7.3CVE-2026-52858EPSS 0.2%

    Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +pyth…

  24. 9.5CVE-2026-47174EPSS 0.4%

    In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment se…

  25. 9.5CVE-2026-47172EPSS 0.4%

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflo…

  26. 7.7CVE-2026-44495EPSS 0.9%

    Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has…

  27. 8.7CVE-2026-44494EPSS 1.1%

    Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's depende…

  28. 8.8CVE-2026-7870EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

  29. 7.8CVE-2026-10847EPSS 0.1%

    A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution…

  30. 9.8CVE-2026-41699EPSS 0.4%

    Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a pag…

  31. 8.9CVE-2026-46654EPSS 0.1%

    Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-S…

  32. 7.5CVE-2026-46625EPSS 0.9%

    JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the…

  33. 8.4CVE-2026-46529EPSS 0.5%

    Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code executio…

  34. 8.8CVE-2026-20251EPSS 32%

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a…

  35. 5.3CVE-2026-48096EPSS 0.1%

    OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result …

  36. 8.5CVE-2026-8637EPSS 0.1%

    A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.

  37. 8.8CVE-2026-53435EPSS 53%

    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows the…

  38. 8.6CVE-2026-52751EPSS 0.7%

    Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that…

  39. 8.4CVE-2026-10721EPSS 0.1%

    Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialize…

  40. 5.3CVE-2026-11815EPSS 0.3%

    An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code exe…

  41. 5.9CVE-2026-46539EPSS 0.1%

    Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without perform…

  42. 7.8CVE-2026-46517EPSS 0.2%

    LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

  43. 8.1CVE-2026-41732EPSS 0.3%

    JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trus…

  44. 8.1CVE-2026-41731EPSS 0.5%

    JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's defa…

  45. 7.2CVE-2026-40993EPSS 0.2%

    An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verifi…

  46. 9.4CVE-2026-44963EPSS 2.4%

    A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

  47. 7.7CVE-2026-47937EPSS 0.2%

    Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privil…

  48. 7.8CVE-2026-48565EPSS 0.4%

    Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

  49. 5.4CVE-2026-48560EPSS 0.9%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  50. 7.0CVE-2026-47648EPSS 0.2%

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.