cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 8

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.5CVE-2026-105442EPSS 0.4%

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messagi…

  2. 8.6CVE-2026-103847EPSS 0.2%

    Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with…

  3. 8.6CVE-2026-103845EPSS 0.2%

    Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute…

  4. 7.5CVE-2026-96237EPSS 0.6%

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

  5. 7.8CVE-2026-96186EPSS 2.4%

    Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

  6. 7.8CVE-2026-88091EPSS 2.9%

    Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

  7. 8.8CVE-2026-87697EPSS 0.8%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  8. 7.8CVE-2026-87695EPSS 0.3%

    Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-87692EPSS 2.3%

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

  10. 7.5CVE-2026-86063EPSS 0.2%

    Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character…

  11. 8.8CVE-2026-85900EPSS 1.5%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  12. 7.0CVE-2026-85355EPSS 0.3%

    Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

  13. 8.8CVE-2026-83520EPSS 1.4%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  14. 7.0CVE-2026-83509EPSS 0.4%

    Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  15. 7.8CVE-2026-83506EPSS 0.4%

    Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

  16. 7.0CVE-2026-83505EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  17. 7.2CVE-2026-70267EPSS 1.0%

    Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  18. 7.8CVE-2026-70142EPSS 0.5%

    Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.

  19. 8.8CVE-2026-70035EPSS 1.4%

    Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

  20. 7.8CVE-2026-69923EPSS 0.6%

    Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.

  21. 7.8CVE-2026-69882EPSS 0.6%

    Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-69733EPSS 0.6%

    Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

  23. 8.8CVE-2026-108398EPSS 0.8%

    Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

  24. 7.4CVE-2026-105013EPSS 1.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  25. 8.8CVE-2026-100214EPSS 2.1%

    Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

  26. 7.7CVE-2026-110102EPSS 0.1%

    Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned …

  27. 10.0CVE-2026-55675EPSS 0.4%

    The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, …

  28. 5.4CVE-2026-4869EPSS 0.1%

    A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.e…

  29. 8.6CVE-2026-102250EPSS 0.2%

    CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

  30. 7.8CVE-2026-65180EPSS 0.2%

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation…

  31. 7.8CVE-2026-65110EPSS 0.2%

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escal…

  32. 8.6CVE-2026-108971EPSS 0.2%

    A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of the argument firmware can lead to improp…

  33. 2.1CVE-2026-108958EPSS 0.3%

    A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to de…

  34. 2.1CVE-2026-108948EPSS 0.3%

    A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The…

  35. 1.9CVE-2026-108947EPSS 0.2%

    A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The att…

  36. 7.8CVE-2026-75782EPSS 0.1%

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

  37. 8.9CVE-2026-49483EPSS 0.1%

    Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reli…

  38. 9.1CVE-2026-92119EPSS 0.3%

    REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

  39. 6.3CVE-2026-109365EPSS 0.1%

    Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only …

  40. 7.0CVE-2026-109361EPSS 0.2%

    MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can…

  41. 7.7CVE-2026-109360EPSS 0.6%

    MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that…

  42. 8.7CVE-2026-109359EPSS 0.1%

    Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay …

  43. 8.6CVE-2026-109237EPSS 0.3%

    Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_tok…

  44. 9.2CVE-2026-109391EPSS 0.5%

    Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-con…

  45. 8.8CVE-2026-12613EPSS 0.3%

    Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Docum…

  46. 8.8CVE-2026-52903EPSS 0.4%

    A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticat…

  47. 8.7CVE-2026-109186EPSS 0.4%

    jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update …

  48. 6.9CVE-2026-21127EPSS 0.1%

    Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

  49. 7.1CVE-2026-108913EPSS 0.4%

    omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

  50. 7.2CVE-2026-108740EPSS 0.3%

    GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access c…