cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 7

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.5CVE-2026-105036EPSS 0.2%

    EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacke…

  2. 9.3CVE-2026-47218EPSS 0.4%

    runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-c…

  3. 8.7CVE-2026-111160EPSS 0.4%

    LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single…

  4. 7.5CVE-2026-110874EPSS 0.5%

    Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, ex…

  5. 9.1CVE-2026-102946EPSS 0.1%

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures ar…

  6. 8.6CVE-2026-55103EPSS 0.2%

    Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches t…

  7. 8.3CVE-2026-77470EPSS 0.5%

    Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges…

  8. 9.4CVE-2026-110812EPSS 0.4%

    Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service creden…

  9. 9.8CVE-2026-111094EPSS 0.4%

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

  10. 7.8CVE-2026-111091EPSS 0.1%

    In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

  11. 9.1CVE-2026-47168EPSS 0.4%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later des…

  12. 8.4CVE-2026-110936KEVEPSS 1.0%

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to pl…

  13. 7.5CVE-2026-93649EPSS 0.2%

    In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query p…

  14. 9.8CVE-2026-109686EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

  15. 9.2CVE-2026-102469EPSS 0.5%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a ba…

  16. 9.3CVE-2026-101287EPSS 0.4%

    Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authenticati…

  17. 5.3CVE-2026-92429EPSS 0.1%

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce o…

  18. 5.3CVE-2026-92428EPSS 0.1%

    The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce o…

  19. 5.3CVE-2026-103324EPSS 0.1%

    The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated a…

  20. 8.1CVE-2026-104108EPSS 0.2%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and d…

  21. 5.9CVE-2026-0315EPSS 0.1%

    A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administr…

  22. 8.7CVE-2026-110761EPSS 0.6%

    ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a mal…

  23. 5.6CVE-2026-102682EPSS 0.2%

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start,…

  24. 9.8CVE-2026-55573EPSS 0.7%

    e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting al…

  25. 9.9CVE-2026-108390EPSS 0.7%

    Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user…

  26. 8.2CVE-2026-102695EPSS 0.3%

    OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that…

  27. 8.8CVE-2026-73800EPSS 0.5%

    Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes w…

  28. 6.5CVE-2026-66874EPSS 0.3%

    For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a r…

  29. 7.1CVE-2026-110607EPSS 0.3%

    BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log…

  30. 7.2CVE-2026-97278EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.

  31. 9.8CVE-2026-108291EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

  32. 8.8CVE-2026-106599EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

  33. 5.3CVE-2026-88998EPSS 0.1%

    The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a paymen…

  34. 5.3CVE-2026-82844EPSS 0.1%

    The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms with…

  35. 6.5CVE-2026-103308EPSS 0.1%

    The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthen…

  36. 7.9CVE-2026-73793EPSS 0.3%

    HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.

  37. 7.2CVE-2026-104764EPSS 0.6%

    The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with adm…

  38. 5.3CVE-2026-108069EPSS 0.2%

    The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comme…

  39. 5.3CVE-2026-107160EPSS 0.2%

    The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered t…

  40. 8.2CVE-2026-93905EPSS 0.3%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

  41. 8.8CVE-2026-65674EPSS 1.6%

    Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

  42. 9.3CVE-2026-49950EPSS 0.9%

    Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.rec…

  43. 7.5CVE-2026-105442EPSS 0.4%

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messagi…

  44. 8.6CVE-2026-103847EPSS 0.2%

    Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with…

  45. 8.6CVE-2026-103845EPSS 0.2%

    Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute…

  46. 7.5CVE-2026-96237EPSS 0.6%

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

  47. 7.8CVE-2026-96186EPSS 2.4%

    Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

  48. 7.8CVE-2026-88091EPSS 2.9%

    Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

  49. 8.8CVE-2026-87697EPSS 0.8%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  50. 7.8CVE-2026-87695EPSS 0.3%

    Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.