CVE-2026-106456: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

CVE-2026-103831: Deserialization of Untrusted Data

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-105806: Missing Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105860: Missing Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants...

CVE-2026-105848: Exposed Dangerous Method or Function

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-104036: Out-of-bounds Write

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to...

CVE-2026-89289: Missing Authorization

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

CVE-2026-106513: Improper Access Control

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...

PT-2026-106752

Name of the Vulnerable Software and Affected Versions Microsoft.OpenApi.Kiota versions 1.25.1 through 1.34.1 Microsoft.OpenApi.Kiota.Builder versions 1.25.1 through 1.34.1 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate the x-ai-capabilities.response...

CVE-2026-106508: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-105850: Improper Enforcement of a Single, Unique Action

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Stripe order confirmation to be processed more than once under certain conditions...

PT-2026-106331

Name of the Vulnerable Software and Affected Versions WP Synchro versions prior to 1.16.2 Description A subscriber bypass issue exists in the WP Migration Plugin DB & Files, allowing users with subscriber-level privileges to bypass intended restrictions. Recommendations Update to a version newer...

PT-2026-106707

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

WS-2026-0153

@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.89.0 and 4.0.0-canary.0 through 4.0.0-canary.30: the experimental MCP forgotPassword tool accepted disableEmail and returned the raw forgotPassword result, exposing another user's password-reset token, and resetPassword/unlock ran with...

PT-2026-107304

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissio...

PT-2026-107269

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.4.20 Description The @backstage/plugin-auth-backend-module-oidc-provider package contains improper authentication within the OIDC provider. In deployments utilizing OIDC email-based identity resolution with a...

PT-2026-107247

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-bitbucket-server versions 0.4.0 through 0.5.14 Description Inconsistent repository filtering occurs during Bitbucket Server catalog event updates. Deployments utilizing event-driven updates may ingest...

PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

PT-2026-107305

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package allows potential file exposure when the local TechDocs publisher is used via the techdocs.publisher.type variable set to 'local'. In this configuration,...

PT-2026-106288

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to...