CVE-2026-106489

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-106489

The Backstage framework is vulnerable in the @backstage/plugin-techdocs-backend package prior to version 2.2.4 due to improper authorization enforcement for TechDocs static content. An authenticated user with access to one documentation site can craft a URL to read documentation belonging to a di...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

xxexploiter

XXExploiter Il génère les charges utiles XML et démarre automatiquement un serveur pour servir les DTD nécessaires ou effectuer l'exfiltration de données. Installation install node and npm if you don't have it yet npm install -g xxexploiter Compilation et exécution à partir des sources Il s'agit...

CVE-2026-96399

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

magescan

Mage Scan L'idée derrière cet outil est d'évaluer la qualité et la sécurité d'un site Magento auquel vous n'avez pas accès. Le scénario typique : vous interviewez un développeur potentiel ou évaluez un nouveau client, et vous souhaitez avoir une idée de ce à quoi vous avez affaire. Installation...

CVE-2026-96399 Gitea denial of service through external issue tracker patterns

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

CVE-2026-96399

The Gitea platform is vulnerable to a denial of service via a runtime panic. A repository's external issue tracker regular expression containing alternating capture groups can produce invalid slice indexes during the rendering of issue references. An attacker with permissions to edit a repository...

EUVD-2026-93921

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

CVE-2026-96399 Gitea denial of service through external issue tracker patterns

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2026-9226

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL...

CVE-2016-4014

CVE-2016-4014 SAP Netweaver JAVA AS UDDI Component XXE POST /uddi/api/replication HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Content-Type: text/xml;charset=UTF-8...

CVE-2026-105861

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

morty

Morty Proxy de nettoyage de contenu web en tant que service Morty réécrit les pages web pour exclure les balises et attributs HTML malveillants. Il remplace également les références aux ressources externes pour empêcher les fuites d'informations vers des tiers. L'objectif principal de morty est d...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

CVE-2026-105861

The headless content management system Payload is vulnerable in versions after 3.0.0 and before 3.90.0 . The flaw resides in the authenticated external URL-based upload retrieval feature, where the system fails to verify the trustworthiness of a redirected destination. This origin validation erro...

CVE-2026-105861 Payload external upload trust validation issue

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...