EUVD-2026-92770

Ghost: Stored XSS via File Uploads on Local Storage...

Ghost: Stored XSS via File Uploads on Local Storage

Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...

GHSA-GFJP-2P8F-94QV Ghost: Stored XSS via File Uploads on Local Storage

Impact Ghost restricts the content type that uploaded files are served with, to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file...

NPM: Ghost: Stored XSS via File Uploads on Local Storage

NPM: Ghost: Stored XSS via File Uploads on Local Storage vulnerability discovered by ? in WordPress Npm ghost versions = 6.22.1, 6.64.0...

EUVD-2026-94008

Backstage: Improper authorization enforcement for TechDocs static content...

GHSA-RG9R-HR7G-5GC2 Backstage: Improper authorization enforcement for TechDocs static content

Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider S3, GCS, etc. and the permission framework...

Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

EUVD-2026-94009

Backstage: Improper input validation in TechDocs static content requests...

GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests

Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...

Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

EUVD-2026-94013

Backstage: Cloud storage catalog locations may cross configured storage boundaries...

GHSA-XVH9-35W9-42M4 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...

Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

GHSA-7649-WM97-W3J3 Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

EUVD-2026-94015

Backstage: Improper input validation in cloud storage URL readers...

GO-2026-6624 SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel...

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

The U.S. Federal Bureau of Investigation FBI and Secret Service USSS on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer SSL virtual private network VPN gateways. "The campaign...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...

CVE-2026-106493

A flaw was found in Backstage. Cloud storage catalog providers do not sufficiently validate object paths. An attacker with permissions to create or rename objects in a configured cloud storage source, such as Amazon Web Services AWS S3 or Azure Blob Storage, can cause catalog descriptors to be re...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320：Abacre Restaurant Point of Sale POS 中的内存敏感信息明文存储漏洞。 所有版本（最高至 15.0.0.1656）的 Abacre Restaurant Point of Sale POS 均存在内存中敏感信息明文存储漏洞。在激活尝试期间，应用程序会将有效的、绑定设备的许可证密钥保留在进程内存中。攻击者可通过将进程附加到调试器并分析进程/内存转储来获取这些密钥，然后无需购买即可在同一台机器上激活软件。 下面，我们提供了动态分析和调试器输出的证据，表明这些密钥在激活尝试期间被分配并保留在进程内存中。...