Advisories · Weakness

CWE-706.

Every Advisory and CVE whose sources give the weakness CWE-706, newest first.

CVE-2026-121200 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38…
- Google Chrome
- CWE-706
Not analysed yet 3 Nov 2026
CVE-2026-121133 CVE record

CVSS 8.1 High

Google Chrome: Incorrect reference resolution in Images in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 3 Nov 2026
CVE-2026-119675 CVE record

CVSS 5.2 Medium

mongorestore may bypass collection guards through a system.buckets prefix
- MongoDB Database Tools
- CWE-706
Not analysed yet 3 Nov 2026
CVE-2026-118938 CVE record

CVSS 8.8 High

Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
- trailofbits fickling
- Insecure deserialization
- CWE-706
Not analysed yet 30 Oct 2026
CVE-2026-119270 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79…
- Google Chrome
- CWE-706
Not analysed yet 30 Oct 2026
CVE-2026-119266 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a…
- Google Chrome
- CWE-706
Not analysed yet 30 Oct 2026
CVE-2026-119265 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a…
- Google Chrome
- CWE-706
Not analysed yet 30 Oct 2026
filelock PyPI

CVSS 6.1 Medium

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
- CWE-706
<4.2.1 · fixed in 4.2.1

GHSA-69hj-f68j-2879 · CVE-2026-112909 Not analysed yet 28 Oct 2026
CVE-2026-118309 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 27 Oct 2026
CVE-2026-118314 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 27 Oct 2026
CVE-2026-89313 CVE record

CVSS 6.3 Medium

JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-706
Not analysed yet 23 Oct 2026
CVE-2026-114663 CVE record

CVSS 8.6 High

Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
- vyper
- CWE-706
Not analysed yet 22 Oct 2026
CVE-2026-14288 CVE record

CVSS 3.1 Low

Use of Incorrectly-Resolved Name or Reference in GitLab
- GitLab
- CWE-706
Not analysed yet 21 Oct 2026
CVE-2026-113223 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47…
- Google Chrome
- CWE-706
Not analysed yet 20 Oct 2026
CVE-2026-113159 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47…
- Google Chrome
- CWE-706
Not analysed yet 20 Oct 2026
CVE-2026-113102 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47…
- Google Chrome
- CWE-706
Not analysed yet 20 Oct 2026
CVE-2026-113034 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47…
- Google Chrome
- CWE-706
Not analysed yet 20 Oct 2026
CVE-2026-92262 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
- MariaDB server
- CWE-706
Not analysed yet 16 Oct 2026
CVE-2026-61844 CVE record

CVSS 7.1 High

FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
- error311 FileRise
- CWE-706
Not analysed yet 14 Oct 2026
CVE-2026-110156 CVE record

CVSS 8.3 High

Google Chrome: Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 13 Oct 2026
CVE-2026-78359 CVE record

CVSS 5.4 Medium

Duplicate Identity / Identity Shadowing across CustomerUser backends
- OTRS
- OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
- CWE-694
- CWE-706
Not analysed yet 12 Oct 2026
CVE-2026-107822 CVE record

CVSS 6.4 Medium

MariaDB: database privilege escalation via user / role name collision in the acl cache
- MariaDB server
- Broken access control
- CWE-706
Not analysed yet 9 Oct 2026
CVE-2026-95106 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Gitea review and execution mismatch through duplicate tree entries
- Gitea
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106325 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106409 CVE record

CVSS 8.3 High

Google Chrome: Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106230 CVE record

CVSS 5.3 Medium

Google Chrome: Incorrect reference resolution in Offline in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106279 CVE record

CVSS 7.4 High

Google Chrome: Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106274 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in Browser in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106181 CVE record

CVSS 5.3 Medium

Google Chrome: Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
CVE-2026-106308 CVE record

CVSS 8.8 High

Google Chrome: Incorrect reference resolution in Autofill in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 6 Oct 2026
vm2 npm

CVSS 9.4 CriticalCritical · CVSS 9+

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
- Broken access control
- CWE-706
<3.11.7 · fixed in 3.11.7

GHSA-c48m-32m9-vx93 · CVE-2026-92951 Not analysed yet 1 Oct 2026
CVE-2026-95334 CVE record

CVSS 8.3 High

Google Chrome: Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57…
- Google Chrome
- CWE-706
Not analysed yet 29 Sept 2026
CVE-2026-95275 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57…
- Google Chrome
- CWE-706
Not analysed yet 29 Sept 2026
CVE-2026-87720 CVE record

CVSS 7.6 High

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review
- Gerrit
- Authentication bypass
- Broken access control
Not analysed yet 24 Sept 2026
CVE-2026-85491 CVE record

CVSS 8.8 High

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone
- CWE-706
- CWE-1023
Not analysed yet 24 Sept 2026
CVE-2026-77605 CVE record

CVSS 7.8 High

Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
- notepad-plus-plus
- CWE-20
- CWE-706
Not analysed yet 22 Sept 2026
CVE-2026-93375 CVE record

CVSS 8.1 High

Google Chrome: Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to…
- Google Chrome
- CWE-706
Not analysed yet 17 Sept 2026
vm2 npm

CVSS 9.9 Critical

Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
- CWE-706
<=3.11.6 · no fixed version yet

GHSA-6fvh-fgmg-3x7v Withdrawn Not analysed yet 17 Sept 2026
CVE-2026-91727 CVE record

CVSS 8.1 High

Google Chrome: Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 15 Sept 2026
CVE-2026-88621 CVE record

CVSS 2.7 Low

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php.
- CWE-706
Not analysed yet 15 Sept 2026
CVE-2026-25825 CVE record

CVSS 2.7 Low

An issue was discovered in Keyfactor SignServer before 7.6.0.
- CWE-706
Not analysed yet 15 Sept 2026
CVE-2026-87618 CVE record

CVSS 8.3 High

Google Chrome: Incorrect reference resolution in Storage in Google Chrome on on Windows prior to…
- Google Chrome
- CWE-706
Not analysed yet 9 Sept 2026
CVE-2026-87562 CVE record

CVSS 5.4 Medium

Google Chrome: Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to…
- Google Chrome
- CWE-706
Not analysed yet 9 Sept 2026
CVE-2026-87613 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Google Chrome: Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36…
- Google Chrome
- CWE-706
Not analysed yet 9 Sept 2026
CVE-2026-87547 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36…
- Google Chrome
- CWE-706
Not analysed yet 9 Sept 2026
CVE-2026-81383 CVE record

CVSS 7.4 High

Visual Studio Code Information Disclosure Vulnerability
- Microsoft Visual Studio Code
- CWE-706
Not analysed yet 8 Sept 2026
nltk PyPI

CVSS 8.2 High

NLTK: Stable FrameNet and NKJP readers parse outside-root XML
- Path traversal
- CWE-706
<3.10.0 · fixed in 3.10.0

GHSA-568f-pv23-39p4 · CVE-2026-62385 Not analysed yet 8 Sept 2026
CVE-2026-79254 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-79273 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in WebView in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-79103 CVE record

CVSS 3.1 Low

Google Chrome: Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-79070 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-79049 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-79264 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-78942 CVE record

CVSS 4.3 Medium

Google Chrome: Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-78985 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Google Chrome: Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65…
- Google Chrome
- CWE-706
Not analysed yet 25 Aug 2026
CVE-2026-67602 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
- phpipam
- CWE-706
Not analysed yet 24 Aug 2026
CVE-2026-65816 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Azure Arc Elevation of Privilege Vulnerability
- Microsoft Azure Web Apps
- CWE-706
Not analysed yet 20 Aug 2026
CVE-2026-13097 CVE record

CVSS 8.7 High

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- CWE-706
Not analysed yet 20 Aug 2026
CVE-2026-76039 CVE record

CVSS 6.5 Medium

Google Chrome: Incorrect reference resolution in Core in Google Chrome on on Android prior to…
- Google Chrome
- CWE-706
Not analysed yet 18 Aug 2026
CVE-2026-29036 CVE record

CVSS 8.7 High

cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding
- DaveGamble cJSON
- CWE-706
Not analysed yet 11 Aug 2026