CVE-2026-13410

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress versions 8.0 - 9.6.2 is vulnerable to privilege escalation due to insufficient validation of the 'type' parameter in the customer update endpoint. This allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when 'externalId' is set to 0. Unauthenticated attackers can escalate to administrator by first elevating to manager, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.

Team Password Manager before version 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Use after free in Shared Tab Groups in Google Chrome on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use after free in WebGL in Google Chrome on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use-after-free in Dawn in Google Chrome on Android prior to 152.0.7977.75. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

Predis, a Redis and Valkey client for PHP, versions 3.0.0-RC1 through 3.3.0, improperly processes the RESP buffer in aggregate connections, allowing an attacker to inject additional commands via keys or values containing CRLF sequences. This can lead to shard-wide cache deletion, targeted data modification, data reads, or node disruption. Only pipeline() is affected; transactions are not vulnerable. Fixed in version 3.3.0.