CVE-2026-87613

A flaw was found in Chromium Extensions. A remote attacker could exploit an incorrect reference resolution vulnerability by sending crafted network traffic. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sybre Waaijer in WordPress Plugin Slim SEO versions = 4.10.0...

PT-2026-90359

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the audit system where the audit del rule function incorrectly handles tree references. The function is used for both netlink deletion templates and internal fsnotify...

CVE-2026-89590: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89453: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2024-12145: Missing Authorization

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-82213: Authorization Bypass Through User-Controlled Key

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

CVE-2026-84941: Improper Restriction of XML External Entity Reference

An information disclosure vulnerability in the SAML Single Sign-On SSO functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could...

PT-2026-90028

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

PT-2026-90252

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where a race condition occurs during the client TLS handshake. The function xs tls handshake sync provides a reference to the lower transport to x...

PT-2026-90228

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device reference leak occurs in the remoteproc scp component. The issue arises when attempting to look up driver data for the SCP device before the driver has been bound, as the...

PT-2026-96506

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

PT-2026-96415

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

PT-2026-90431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the NFS localio component when the nfs uuid add file function races with nfs uuid put during the teardown of uuid-net. In this scenario, the system returns...

PT-2026-90125

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel within the MCTP Management Component Transport Protocol implementation. The mctp route lookup function accesses the rt-dev device withou...

PT-2026-90162

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd component where the iommufd take all iova rwsem function fails to properly release an object reference and the iova rwsem write lock when xa store fails...

CVE-2026-18061: Improper Restriction of XML External Entity Reference

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

PT-2026-90220

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the as3722 get regulator dt data function, of get child by name acquires a reference on np, which is assigned to pdev-dev.of node. The function then immediately calls of node putnp,...

PT-2026-90169

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommu/amd component where PCI device references are leaked during the handling of PPR Page Request Interface faults. The iommu call iopf notifier function uses pci...

PT-2026-96445

In the Linux kernel, the following vulnerability has been resolved: mm/migrate device: clear stale mapping after freeing swapcache migrate device pages reads the folio mapping before calling folio free swap. When folio free swap succeeds, the folio is removed from the swap cache, but the saved...