GHSA-53VV-XM9F-MM82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. Vulnerable versions This vulnerability is present in Ghost from v0.7.2 u...

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API

NPM: Ghost: Password Hash Ordering Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 0.7.2, 6.64.0...

Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

GHSA-VWP5-F99X-X3RQ Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions = 6.0.5...

CVE-2026-106506

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506 Backstage: Improper input validation in scaffolder task list ordering

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506

The Backstage framework is vulnerable to improper input validation within the @backstage/plugin-scaffolder-backend package in versions prior to 4.1.0 . This flaw exists in the scaffolder task list ordering functionality, potentially allowing an authenticated user with permissions to create and re...

CVE-2026-106506 Backstage: Improper input validation in scaffolder task list ordering

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-105797

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

EUVD-2026-93426

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-98228

The Linux kernel contains a vulnerability on MIPS I6500 CPU cores due to a lack of ordering guarantees for lld and scd instructions. This issue requires the injection of sync instructions above and below lld/scd loops using the WEAK_REORDERING_BEYOND_LLSC infrastructure to ensure arch_cmpxchg() r...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

PT-2026-106557

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description On I6500 CPU cores, the lld and scd instructions do not provide ordering guarantees. This causes an issue where the assumption that the arch cmpxchg function is fully ordered is violated...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-106506: Exposure of Sensitive Information Through Data Queries

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-105444

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105444 dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105444

A security flaw exists in dotnet eShop .NET 8 within the Ordering API component. Specifically, the GetOrderAsync function in the file src/Ordering.API/Apis/OrdersApi.cs is vulnerable to resource injection (CWE-99). By manipulating the OrderNumber argument, an attacker can achieve improper control...