AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1791403199)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791403199 advisory. - The stringprep module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were use...

CVE-2026-106559: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

PT-2026-107692

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Description An issue exists where a user with the list spl2 modules capability can perform SQL injection through SPL2 module filtering. This occurs because the software fails to parameterize...

CVE-2026-76270: Improper Neutralization of Special Elements used in an SQL Command

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

PT-2026-107534

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions prior to 0.3.25 Description Improper input validation in the Confluence to Markdown scaffolder module allows an attacker to influence file write operations during...

ROS-20261007-73-0051

The vulnerability of the simplifysymbols function in the kernel/module/main.c module of the Linux operating system is related to the improper checking of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-107750

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

PT-2026-107756

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

PT-2026-107770

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or...

PT-2026-107748

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic...

PT-2026-107542

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-confluence-to-markdown versions prior to 0.3.25 Description Improper repository path validation in a scaffolder backend module allows an authenticated user who can execute an affected template and...

CVE-2026-106560: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106562: Improper Check for Unusual or Exceptional Conditions

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

CVE-2026-106439

A flaw was found in hydra-core. Target execution policies used during object instantiation are stored in mutable module-level state. An attacker who supplies crafted configuration entries can manipulate this policy to remove restrictions on blocked targets. Successful exploitation allows the...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20230323021924, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106509 via @backstage/plugin-techdocs-node (>=0.0.0-nightly-20220315022536, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =0.0.0-nightly-20220315022536, =0.0.0-nightly-20230323021924, =0.0.0-nightly-2021111822616, =0.0.0-nightly-20220305022735, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106509 Source advisory: MEND:CVE-2026-106509...

CVE-2026-106486

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-106488

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106457

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106458

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the...