CVE-2026-104898: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-91050: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

CVE-2026-93746: Authorization Bypass Through User-Controlled Key

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest printdocumentfromthemaillink handler dispatched from...

CVE-2026-108608: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET...

CVE-2026-108164: Authorization Bypass Through User-Controlled Key

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

CVE-2026-108641: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

EUVD-2026-78655

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated projectviewid in the task position endpoint v1 and v2...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

CVE-2026-106409

An incorrect reference resolution flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559097675...

CVE-2026-106230

An incorrect reference resolution flaw was found in the Offline component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/520507737...

CVE-2026-106274

An incorrect reference resolution flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497842821...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin LatePoint versions = 5.7.2...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Bookly versions = 28.4...

CVE-2026-98235

A flaw was found in the Linux kernel's network traffic control subsystem. When processing a batched request to delete traffic actions, a failure encountered on an action bound to a filter causes the cleanup process to terminate prematurely without releasing references on subsequent actions. A loc...

CVE-2026-106181

An incorrect reference resolution flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/497350668...

ROOT-OS-UBUNTU-2204-CVE-2026-43022 CVE-2026-43022 in linux - Patched by Root

Root has patched CVE-2026-43022 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

CVE-2026-98191

A flaw was found in the Linux kernel's wlcore Wi-Fi driver. When configuring a wireless regulatory domain fails, the driver does not release an acquired runtime Power Management PM reference. A local user could exploit this flaw during device configuration failures to cause a reference count leak...

GHSA-9RJX-3JCH-6VJF enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

Summary A crafted SVG bypasses enshrined/svg-sanitize's href validation and delivers a javascript: URL through the sanitizer unchanged. The bypass exploits a semantic mismatch between XML entity resolution used during sanitization and HTML5 Named Character Reference resolution used by the browser...

CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...