CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106490

The Backstage framework is vulnerable to an improper input validation flaw in the @backstage/plugin-techdocs-backend package prior to version 2.2.4 . When utilizing the Azure Blob Storage provider , an authenticated user may be able to access restricted TechDocs content if entity-level permission...

CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-106489

The Backstage framework is vulnerable in the @backstage/plugin-techdocs-backend package prior to version 2.2.4 due to improper authorization enforcement for TechDocs static content. An authenticated user with access to one documentation site can craft a URL to read documentation belonging to a di...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-70414

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

DEBIAN-CVE-2026-106393

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106393

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-70414

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-70414

Dell Command | Configure (DCC) versions prior to 5.2.3.35 are affected by a Plaintext Storage of Password vulnerability (CWE-256). A low privileged attacker with local access could exploit this flaw to cause Information Disclosure . No specific exploit details are provided in the documentation. R...

CVE-2026-70414

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

EUVD-2026-93656

Dell Command | Configure DCC, versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-106393

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93826

Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106393

A use after free vulnerability in the Storage component of Google Chrome (prior to version 155.0.8059.39 ) allows a remote attacker to execute arbitrary code outside the sandbox. This attack is possible via a crafted HTML page if the attacker has already compromised the renderer process . Exploit...