CVE-2026-106505

A flaw was found in the plugin-techdocs-node component of Backstage. This vulnerability allows an attacker with permission to commit changes to a repository utilizing TechDocs to bypass the MkDocs configuration sanitizer. By supplying a crafted configuration file, the attacker can achieve arbitra...

CVE-2026-106455

A flaw was found in the Backstage @backstage/plugin-techdocs-node package. This vulnerability allows information disclosure when an authenticated attacker with control over a TechDocs documentation repository exploits improper validation of MkDocs plugin configurations. During documentation build...

CVE-2026-106498

A flaw was found in @backstage/plugin-catalog-backend. An authenticated remote user can craft a catalog entity containing placeholder directives that reference resources outside the entity's source repository due to improper URL validation. Under certain configurations, this can lead to informati...

CVE-2026-106500

A flaw was found in @backstage/plugin-scaffolder-backend. Due to improper task state validation, an authenticated user with permissions to create and access Scaffolder tasks can affect files accessible to the Backstage backend under specific timing and deployment conditions. If the backend...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

PT-2026-107397

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

PT-2026-107532

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

PT-2026-107709

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.1.2 Vault Enterprise versions prior to 2.1.2 Vault Enterprise versions prior to 1.21.12 Vault Enterprise versions prior to 1.20.17 Vault Enterprise versions prior to 1.19.23 Description Vault and Vau...

CVE-2026-103323: Missing Authorization

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when...

CVE-2026-96530: Exposure of Sensitive Information to an Unauthorized Actor

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-105816: Improper Limitation of a Pathname to a Restricted Directory

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

PT-2026-107544

Name of the Vulnerable Software and Affected Versions @backstage/plugin-search-backend versions prior to 2.1.6 @backstage/plugin-search-backend-module-elasticsearch versions prior to 1.8.7 Description An authenticated user could receive unauthorized search results when a DENY policy is applied to...

CVE-2026-106556: Improper Neutralization of Special Elements used in an OS Command

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

CVE-2026-106559: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

PT-2026-107534

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions prior to 0.3.25 Description Improper input validation in the Confluence to Markdown scaffolder module allows an attacker to influence file write operations during...

CVE-2026-104953: Improper Neutralization of Special Elements used in an SQL Command

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

PT-2026-107416

Name of the Vulnerable Software and Affected Versions Magee Shortcodes WordPress plugin versions prior to 2.1.2 Description The plugin fails to restrict the recipient of certain unauthenticated contact-form actions. This allows unauthenticated users to perform a mail relay, sending arbitrary emai...

CVE-2026-106558: Deserialization of Untrusted Data

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

PT-2026-107533

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions prior to 1.14.8 @backstage/plugin-techdocs-node versions prior to 1.15.6 @backstage/plugin-techdocs-node versions prior to 2.0.1 Description The @backstage/plugin-techdocs-node package improperly...

CVE-2026-106562: Improper Check for Unusual or Exceptional Conditions

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...