gh-safe-repo

gh-safe-repo Create GitHub repositories with safe defaults applied automatically. Replaces the five-minute post-creation settings checklist with a single command. gh-safe-repo create Branch protection, immutable tags, Dependabot, restricted Actions permissions, and secret scanning with push...

CryptHook

CryptHook CryptHook is a modular implementation for securing existing applications with symmetrical block cipher encryption. It works by hooking the base system calls for network communication send/sendto and recv/recvfrom. Crypthook will work with any existing application that relies on these...

EUVD-2026-94012

Backstage: Improper preservation of access restrictions during service credential delegation...

EUVD-2026-94015

Backstage: Improper input validation in cloud storage URL readers...

Backstage: Improper input validation in cloud storage URL readers

Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...

CVE-2026-106494

A flaw was found in the @backstage/backend-defaults package of Backstage. Improper input validation in cloud storage URL readers allows an attacker with write access to an associated cloud storage bucket to create specially crafted object names. Under certain deployment configurations, these name...

CVE-2026-106492

A flaw was found in @backstage/backend-defaults. The package fails to properly preserve access restrictions during service credential delegation when requests are routed through plugin delegation paths. An authenticated service with limited privileges can exploit this issue to bypass access...

CVE-2026-106492

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106494

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that...

CVE-2026-106494 Backstage: Improper input validation in cloud storage URL readers

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that...

CVE-2026-106494

The Backstage framework, specifically the @backstage/backend-defaults package, is vulnerable to improper input validation in cloud storage URL readers prior to version 0.17.8 . An attacker with write access to a cloud storage bucket used by Backstage can craft object names that collide with prote...

CVE-2026-106494 Backstage: Improper input validation in cloud storage URL readers

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492

The Backstage framework is vulnerable in the @backstage/backend-defaults package prior to versions 0.16.1 and 0.17.8 . The root cause is the improper preservation of access restrictions during service credential delegation. Specifically, an external service credential with restrictions (such as r...

ansible-mysql-cve-2016-6662

ansible-mysql-cve-2016-6662 Simple ansible playbook to patch mysql servers against CVE-2016-6662. UPDATE 20160915.2347.CEST: Kenny informed me of Patrick Forsberg's catch that the original patch did not safeguard against ../ abuse. I've now replaced the patch with one that is more stringent based...

PT-2026-107277

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.16.1 Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package fails to properly preserve access restrictions during service credential delegation. An external service credential...

PT-2026-107279

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sysctl: Always initialize iuid/igid. iuid/igid is always initialized within the sysfs core, so setownership can safely skip setting them. The commit 5ec27ec735ba from “fs/proc/procsysctl.c: fix the default values of iuid/igid on...

p4wned

P4WNED CVE-2026-6043 Perforce Helix Core security research tools and nuclei templates. Research article: https://morganrobertson.net/p4wned/ Please read the above for complete details. Authorised targets only. Use on your own servers or with explicit written permission. Intended audience: Perforc...