CVE-2026-106503: Improper Handling of Case Sensitivity

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

ROS-20261006-73-0070

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-106462: Unintended Proxy or Intermediary

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...

ROS-20261006-73-0454

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0117

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106322

Unauthenticated Broken Access Control in FluentBooking Pro 2.5.0 versions...

ROS-20261006-73-0181

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0150

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106462

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

CVE-2026-39796: Missing Authorization

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily = 1.0.8 versions...

PT-2026-107202

A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system...

CVE-2026-86362: Improper Access Control

Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-106513: Improper Access Control

MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...

CVE-2026-41560: Missing Authorization

Unauthenticated Broken Access Control in WXD Backup Lite = 1.0.2 versions...

CVE-2026-39751: Missing Authorization

Unauthenticated Broken Access Control in PayPlug for WooCommerce Official = 3.1.0 versions...

CVE-2026-104406: Missing Authorization

Unauthenticated Broken Access Control in picu = 3.10.1 versions...

CVE-2026-39723: Missing Authorization

Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1...

CVE-2026-39599: Missing Authorization

Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...

PT-2026-106377

Unauthenticated Broken Access Control in picu = 3.10.1 versions...

PT-2026-106732

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...