CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue validates an SVG href after XML DTD entity expansion, but saveXML serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a...

CVE-2026-107380

The savg-sanitizer PHP SVG/XML sanitizer is vulnerable to Stored XSS in versions prior to 1.0.0 . The issue stems from a discrepancy between isHrefSafeValue(), which validates href attributes after XML DTD entity expansion, and saveXML(), which serializes the original entity reference after remov...

SUSE CVE-2026-98235

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

SUSE CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

Release of Invalid Pointer or Reference

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-95020

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-106308

An incorrect reference resolution flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/560055258...

CLEANSTART-2026-JQ80765 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details...

EUVD-2026-94652

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

Linux Distros Unpatched Vulnerability : CVE-2026-98244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree...

CVE-2026-105833: Insufficiently Protected Credentials

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-17538 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

DRUPAL-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

DRUPAL-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

CVE-2026-107270

Gophish versions through 0.12.1 are vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) vulnerability. This flaw allows authenticated users to perform an object takeover by supplying sequential IDs in POST requests to the /api/groups/, /api/templates/, /api/pages/, and /api/smtp/ e...

Apple’s Verified Photography System

Apple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone--new models only--without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photograph...

CVE-2026-106279

An incorrect reference resolution flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513757840...

CLEANSTART-2026-GM79198 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the spark package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...