CVE-2026-17538 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

DRUPAL-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

DRUPAL-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

CVE-2026-107270

Gophish versions through 0.12.1 are vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) vulnerability. This flaw allows authenticated users to perform an object takeover by supplying sequential IDs in POST requests to the /api/groups/, /api/templates/, /api/pages/, and /api/smtp/ e...

Apple’s Verified Photography System

Apple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone--new models only--without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photograph...

CVE-2026-106279

An incorrect reference resolution flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513757840...

CLEANSTART-2026-GM79198 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the spark package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

PT-2026-107719

Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference exists because the process step customer function relies solely on is user logged in to validate request...

CVE-2026-107270: Authorization Bypass Through User-Controlled Key

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

Linux Distros Unpatched Vulnerability : CVE-2026-106274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain...

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

Linux Distros Unpatched Vulnerability : CVE-2026-106308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obta...

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

PT-2026-107516

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.6 Description An authenticated attacker can inject arbitrary workout log entries into another user's SlotEntry by providing the victim's slot entry ID in a POST /api/v2/workoutlog/ request. This occurs because the slot...

Linux Distros Unpatched Vulnerability : CVE-2026-106325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data...

PT-2026-107744

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

Server-side Request Forgery (SSRF)

Overview bedrock-agentcore-starter-toolkit is an A starter toolkit for using Bedrock AgentCore Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unrestricted external OpenAPI reference resolution in the agent import functionality. When processing OpenAPI...

CVE-2026-106325

Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106409

Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-106274

Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...