# CWE-706. Every Advisory and CVE whose sources give the weakness CWE-706, newest first. ## Records, newest first - [Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38…](https://agentprime.io/advisories/CVE-2026-121200.md) `CVE-2026-121200` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Images in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-121133.md) `CVE-2026-121133` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-706 - [mongorestore may bypass collection guards through a system.buckets prefix](https://agentprime.io/advisories/CVE-2026-119675.md) `CVE-2026-119675` · CVE record: MongoDB Database Tools · CVSS 5.2 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-706 - [Fickling check_safety() bypass: dotted \_\_qualname\_\_ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis](https://agentprime.io/advisories/CVE-2026-118938.md) `CVE-2026-118938` · CVE record: trailofbits fickling · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization, CWE-706 - [Google Chrome: Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79…](https://agentprime.io/advisories/CVE-2026-119270.md) `CVE-2026-119270` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a…](https://agentprime.io/advisories/CVE-2026-119266.md) `CVE-2026-119266` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a…](https://agentprime.io/advisories/CVE-2026-119265.md) `CVE-2026-119265` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-706 - [filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path](https://agentprime.io/advisories/GHSA-69hj-f68j-2879.md) `GHSA-69hj-f68j-2879`, `CVE-2026-112909` · PyPI `filelock`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-118309.md) `CVE-2026-118309` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-118314.md) `CVE-2026-118314` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-706 - [JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil](https://agentprime.io/advisories/CVE-2026-89313.md) `CVE-2026-89313` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-706 - [Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments](https://agentprime.io/advisories/CVE-2026-114663.md) `CVE-2026-114663` · CVE record: vyperlang vyper · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-706 - [Use of Incorrectly-Resolved Name or Reference in GitLab](https://agentprime.io/advisories/CVE-2026-14288.md) `CVE-2026-14288` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113223.md) `CVE-2026-113223` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113159.md) `CVE-2026-113159` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113102.md) `CVE-2026-113102` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113034.md) `CVE-2026-113034` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-706 - [MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.](https://agentprime.io/advisories/CVE-2026-92262.md) `CVE-2026-92262` · CVE record: MariaDB server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-706 - [FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation](https://agentprime.io/advisories/CVE-2026-61844.md) `CVE-2026-61844` · CVE record: error311 FileRise · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-110156.md) `CVE-2026-110156` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-706 - [Duplicate Identity / Identity Shadowing across CustomerUser backends](https://agentprime.io/advisories/CVE-2026-78359.md) `CVE-2026-78359` · CVE record: OTRS GmbH (former OTRS AG) OTRS and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-694, CWE-706 - [MariaDB: database privilege escalation via user / role name collision in the acl cache](https://agentprime.io/advisories/CVE-2026-107822.md) `CVE-2026-107822` · CVE record: MariaDB server · CVSS 6.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control, CWE-706 - [Gitea review and execution mismatch through duplicate tree entries](https://agentprime.io/advisories/CVE-2026-95106.md) `CVE-2026-95106` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106325.md) `CVE-2026-106325` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-106409.md) `CVE-2026-106409` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Offline in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-106230.md) `CVE-2026-106230` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to…](https://agentprime.io/advisories/CVE-2026-106279.md) `CVE-2026-106279` · CVE record: Google Chrome · CVSS 7.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Browser in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-106274.md) `CVE-2026-106274` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39…](https://agentprime.io/advisories/CVE-2026-106181.md) `CVE-2026-106181` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Autofill in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-106308.md) `CVE-2026-106308` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706 - [vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package](https://agentprime.io/advisories/GHSA-c48m-32m9-vx93.md) `GHSA-c48m-32m9-vx93`, `CVE-2026-92951` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control, CWE-706, CWE-829 - [Google Chrome: Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57…](https://agentprime.io/advisories/CVE-2026-95334.md) `CVE-2026-95334` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57…](https://agentprime.io/advisories/CVE-2026-95275.md) `CVE-2026-95275` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-706 - [Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review](https://agentprime.io/advisories/CVE-2026-87720.md) `CVE-2026-87720` · CVE record: Gerrit Gerrit · CVSS 7.6 High · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass, Broken access control, CWE-706 - [Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone](https://agentprime.io/advisories/CVE-2026-85491.md) `CVE-2026-85491` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-706, CWE-1023 - [Notepad++ “Run by system” executes \*.txt.cmd when user selected \*.txt (target confusion → command execution)](https://agentprime.io/advisories/CVE-2026-77605.md) `CVE-2026-77605` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20, CWE-706 - [Google Chrome: Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to…](https://agentprime.io/advisories/CVE-2026-93375.md) `CVE-2026-93375` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-706 - [Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package](https://agentprime.io/advisories/GHSA-6fvh-fgmg-3x7v.md) `GHSA-6fvh-fgmg-3x7v` · npm `vm2`: affected `<=3.11.6`, no fixed version yet · CVSS 9.9 Critical · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-91727.md) `CVE-2026-91727` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-706 - [OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php.](https://agentprime.io/advisories/CVE-2026-88621.md) `CVE-2026-88621` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-706 - [An issue was discovered in Keyfactor SignServer before 7.6.0.](https://agentprime.io/advisories/CVE-2026-25825.md) `CVE-2026-25825` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Storage in Google Chrome on on Windows prior to…](https://agentprime.io/advisories/CVE-2026-87618.md) `CVE-2026-87618` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to…](https://agentprime.io/advisories/CVE-2026-87562.md) `CVE-2026-87562` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36…](https://agentprime.io/advisories/CVE-2026-87613.md) `CVE-2026-87613` · CVE record: Google Chrome · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36…](https://agentprime.io/advisories/CVE-2026-87547.md) `CVE-2026-87547` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-706 - [Visual Studio Code Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-81383.md) `CVE-2026-81383` · CVE record: Microsoft Visual Studio Code · CVSS 7.4 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-706 - [NLTK: Stable FrameNet and NKJP readers parse outside-root XML](https://agentprime.io/advisories/GHSA-568f-pv23-39p4.md) `GHSA-568f-pv23-39p4`, `CVE-2026-62385`, `PYSEC-2026-3728` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, CWE-706 - [Google Chrome: Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-79254.md) `CVE-2026-79254` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in WebView in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-79273.md) `CVE-2026-79273` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed…](https://agentprime.io/advisories/CVE-2026-79103.md) `CVE-2026-79103` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a…](https://agentprime.io/advisories/CVE-2026-79070.md) `CVE-2026-79070` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65…](https://agentprime.io/advisories/CVE-2026-79049.md) `CVE-2026-79049` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed…](https://agentprime.io/advisories/CVE-2026-79264.md) `CVE-2026-79264` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed…](https://agentprime.io/advisories/CVE-2026-78942.md) `CVE-2026-78942` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65…](https://agentprime.io/advisories/CVE-2026-78985.md) `CVE-2026-78985` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-706 - [phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache](https://agentprime.io/advisories/CVE-2026-67602.md) `CVE-2026-67602` · CVE record: phpipam phpipam · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-706 - [Azure Arc Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65816.md) `CVE-2026-65816` · CVE record: Microsoft Azure Web Apps · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-706 - [Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore](https://agentprime.io/advisories/CVE-2026-13097.md) `CVE-2026-13097` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-706 - [Google Chrome: Incorrect reference resolution in Core in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-76039.md) `CVE-2026-76039` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-706 - [cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding](https://agentprime.io/advisories/CVE-2026-29036.md) `CVE-2026-29036` · CVE record: DaveGamble cJSON · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-706 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .