CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

PT-2026-95236

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...

PT-2026-95399

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A reference-count leak exists in the HAProxy PROXY-v2 message decoder. A remote, unauthenticated attacker can exploit this by sending specially crafted PROXY-protocol v2 headers, specifically...

ROS-20260918-73-0107

The vulnerability in the kernel-lt is related to the use of a name with an incorrect reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-93375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code...

PT-2026-95519

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description An insecure direct object reference exists in the nested attributes handling of the Mongoid object-document mapper. This allows a user with basic application privileges to reference a record...

Linux Distros Unpatched Vulnerability : CVE-2026-93193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/rockchip: analogixdp: Fix OF node reference leak via auto cleanup Sashiko reported a reference leak in rockchipdpdrmencoderenable, the ofgetchildbyname...

Linux Distros Unpatched Vulnerability : CVE-2026-93163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name alrea...

Linux Distros Unpatched Vulnerability : CVE-2026-90354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper...

Linux Distros Unpatched Vulnerability : CVE-2026-90298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds. CVE-2026-90298 Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-93106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved...

Linux Distros Unpatched Vulnerability : CVE-2026-90215

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy...

Linux Distros Unpatched Vulnerability : CVE-2026-90352

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off...

Linux Distros Unpatched Vulnerability : CVE-2026-93126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - remoteproc: qcomq6v5adsp: Fix reference leak for device node When calling ofparsephandlewithargs, the caller is responsible to call ofnodeput to release the...

CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

DEBIAN-CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-93375

Google Chrome on Windows versions prior to 153.0.8010.52 is vulnerable to a high-severity issue where incorrect reference resolution in Tracing allows a local attacker to potentially execute arbitrary code outside the sandbox via a local program. The vulnerability has been addressed in version 15...

EUVD-2026-82477

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-93375

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...