CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

PT-2026-125033

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.2 Backstage versions 4.0.0 through 4.0.1 Description In the @backstage/plugin-catalog-backend component, the DefaultCatalogRulesEnforcer compares the raw location.target URL against catalog.rules, whereas URL...

EulerOS Virtualization 2.13.1 : expat (EulerOS-SA-2026-2369)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory...

AZL-79853 CVE-2026-32776 affecting package expat for versions less than 2.6.4-5

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content...

CVE-2026-32776

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content...

CVE-2026-32776: NULL Pointer Dereference

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content...

Linux Distros Unpatched Vulnerability : CVE-2026-32776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. CVE-2026-32776 Note that Nessus relies on the presence of...