CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

EUVD-2026-94371

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

CVE-2026-106556

The Backstage open framework for developer portals is vulnerable to a configuration bypass in the @backstage/plugin-techdocs-node package prior to versions 1.14.6 and 1.15.4 . The root cause is insufficient validation of MkDocs configuration during TechDocs generation. An authenticated user with ...

CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

EUVD-2026-94370

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203 और CVE-2023-24204 परिचय साइबर सुरक्षा के निरंतर विकसित होते परिदृश्य में, वेब एप्लिकेशन हमलावरों के लिए एक प्रमुख लक्ष्य बने हुए हैं जो कमजोरियों का शोषण करना चाहते हैं। हाल ही में, SourceCodester Simple Customer Relationship Management CRM System v1.0 में दो महत्वपूर्ण कमजोरियाँ...

CVE-2026-106510

The Backstage open framework for developer portals is vulnerable to remote code execution in versions prior to 1.14.6 . The flaw exists in the @backstage/plugin-techdocs-node package, where an authenticated user capable of registering catalog entities can provide a crafted mkdocs.yml file. This i...

EUVD-2026-94365

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107167

The m17n-lib library contains a heap use-after-free write vulnerability in the re_init_ic() function. A user providing specially crafted text input can trigger this condition during input-method state transitions , where the library frees an internal input context object but subsequently attempts...

CVE-2026-107167 M17n-lib: heap use-after-free write in re_init_ic()

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107167 M17n-lib: heap use-after-free write in re_init_ic()

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-107167

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. Thi...

CVE-2026-103435

A flaw was found in claude-code. An attacker with write access to a shared workspace can achieve arbitrary file modification and privilege escalation by exploiting a time-of-check to time-of-use TOCTOU race condition. By replacing a project file with a symbolic link between the permission check a...

CVE-2026-106509

A flaw was found in the Backstage plugin-techdocs-node package. When TechDocs is configured to build documentation locally or within a container, an authenticated user with write access to a registered repository can submit malicious configuration values within the MkDocs theme settings. This fla...

CVE-2026-77621

A flaw was found in Vector. A path traversal vulnerability in the file sink may allow a remote attacker who controls event fields referenced in the output path template to create or overwrite arbitrary files with the privileges of the Vector process. Depending on the files affected, this may resu...

CVE-2026-102258

Post-authentication Stored Cross-Site Scripting XSS vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code i...

GO-2026-6655 SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths Workspace Boundary Bypass in github.com/siyuan-note/siyuan/kernel...

ChamiloLMS-CVE-2023-4220

ChamiloLMS CVE-2023-4220 एक्सप्लॉइट CVE-2023-4220 के लिए पायथन एक्सप्लॉइट, जो Chamilo LMS = 1.11.24 को प्रभावित करने वाली एक अप्रमाणित मनमानी फ़ाइल अपलोड कमजोरी है। यह कमजोरी Chamilo के BigUpload घटक में स्थित है। कमजोर इंस्टॉलेशन पर, अपलोड हैंडलर बिना उचित सत्यापन के PHP फ़ाइल को अपलोड करने की...