CVE-2026-106455

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106455

The @backstage/plugin-techdocs-node package in Backstage (versions 0.11.12 through 1.14.7 and 1.15.5) is vulnerable to CWE-918 (Server-Side Request Forgery) due to improper validation of MkDocs plugin configurations. An authenticated attacker with control over a TechDocs source repository can tri...

CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106455

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...

keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...

keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...

PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

Cisco ASA Missing Authorization (CVE-2025-20362)

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the Snapshot process in source/containerblob/pull.go. An authenticated client with raw LLB access can upload or reference registry or OCI layout blob data that does not match the claimed...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...

keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. Thi...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....