PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

CVE-2026-39728: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

PT-2026-106415

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

PT-2026-107295

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.5.1 Backstage versions prior to 3.6.2 Backstage versions prior to 3.7.2 Backstage versions prior to 3.8.2 Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains improp...

PT-2026-107264

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains incorrect authorization in the scaffolder task listing. This allows an authenticated internal user to view metadata for scaffolder tasks th...

WS-2026-0154

@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.87.1 and 4.0.0-canary.0 through 4.0.0-canary.30: the MCP login tool let the caller set showHiddenFields and overrideAccess on 3.x, so login responses could return hidden fields such as credential data GHSA-jjm7-864w-gg8q...

PT-2026-106341

Name of the Vulnerable Software and Affected Versions elegro Crypto Payment versions prior to 1.0.2 Description The plugin fails to require a shared secret before trusting incoming payment notification requests. This allows unauthenticated attackers to forge payment confirmations and change the...

PT-2026-107281

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains an issue regarding inconsistent catalog property permission evaluation. In environments where value-based catalog permission conditions are us...

PT-2026-106780

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-stripe versions prior to 3.90.0 @payloadcms/plugin-stripe versions prior to 4.0.0-canary.34 Description An authenticated user can perform unintended Stripe operations by accessing the enabled optional Stripe REST proxy. This...

CVE-2026-106458: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the...

PT-2026-106793

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user can assign their own account to other tenants due to the default tenant array...

CVE-2026-106501: Exposure of Sensitive Information to an Unauthorized Actor

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

PT-2026-106782

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-ecommerce versions prior to 3.90.0 @payloadcms/plugin-ecommerce versions prior to 4.0.0-canary.34 Description When using the Stripe payment adapter, a Stripe order confirmation can be processed multiple times under certain...

PT-2026-106339

Name of the Vulnerable Software and Affected Versions Deema Payment Gateway versions prior to 1.1.3 Description The Deema Payment Gateway WordPress plugin fails to verify payments with the payment provider when processing the return from a hosted checkout. Additionally, the plugin does not valida...

CVE-2026-106500: Improper Link Resolution Before File Access

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks...

PT-2026-107267

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-bitbucket-cloud versions prior to 0.3.10 @backstage/plugin-scaffolder-backend-module-bitbucket-server versions prior to 0.2.25 Description Bitbucket pull-request Scaffolder actions fail to sufficient...

CVE-2026-106496: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types...

CVE-2026-106491: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

PT-2026-106776

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.87.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.26 Description An unauthenticated user can cause unintended application behavior when the @payloadcms/plugin-import-export plugin is enabled. By...

CVE-2026-105844: Improperly Controlled Modification of Object Prototype Attributes

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...