CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-102158

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

EUVD-2026-93955

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158 Security Advisory 0190

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158

Improper validation of selected CloudVision CUE application programming interface (API) request parameters allows an authenticated network user to perform SQL injection against the backend. This vulnerability impacts the availability of the system. No specific details regarding affected versions ...

EUVD-2026-92843

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core...

PT-2026-107267

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-bitbucket-cloud versions prior to 0.3.10 @backstage/plugin-scaffolder-backend-module-bitbucket-server versions prior to 0.2.25 Description Bitbucket pull-request Scaffolder actions fail to sufficient...

CVE-2026-106486: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

Rocky Linux 9.2 [CIQ] Security Update: python3-urllib3 (ciqsa-2026_1584)

The Rocky Linux 9.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20261584 advisory. This advisory aggregates security fixes for the python-urllib3 SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-44432. Tenable has extracted the preceding...

PT-2026-107144

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

CVE-2026-102158: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

PT-2026-107297

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains improper task state validation within...

CVE-2026-105753

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

PYSEC-2026-4197

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

PYSEC-2026-4197

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

CVE-2026-105753 vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

CVE-2026-105753 vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

CVE-2026-105753

The vLLM inference and serving engine is vulnerable to a shared-service availability failure in versions prior to 0.28.0 . The root cause is a desynchronization in the mirrored multimodal LRU cache ; if a request is rejected during multimodal rendering, the frontend sender cache commits a media h...