PT-2026-107247

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-bitbucket-server versions 0.4.0 through 0.5.14 Description Inconsistent repository filtering occurs during Bitbucket Server catalog event updates. Deployments utilizing event-driven updates may ingest...

PT-2026-107302

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains a flaw in the techdocs backend that allows a bypass of the mkdocs configuration sanitizer. Users capable of...

PT-2026-107281

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains an issue regarding inconsistent catalog property permission evaluation. In environments where value-based catalog permission conditions are us...

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...

PT-2026-106752

Name of the Vulnerable Software and Affected Versions Microsoft.OpenApi.Kiota versions 1.25.1 through 1.34.1 Microsoft.OpenApi.Kiota.Builder versions 1.25.1 through 1.34.1 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate the x-ai-capabilities.response...

PT-2026-106793

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user can assign their own account to other tenants due to the default tenant array...

CVE-2026-104036: Out-of-bounds Write

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to...

PT-2026-106782

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-ecommerce versions prior to 3.90.0 @payloadcms/plugin-ecommerce versions prior to 4.0.0-canary.34 Description When using the Stripe payment adapter, a Stripe order confirmation can be processed multiple times under certain...

PT-2026-107267

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend-module-bitbucket-cloud versions prior to 0.3.10 @backstage/plugin-scaffolder-backend-module-bitbucket-server versions prior to 0.2.25 Description Bitbucket pull-request Scaffolder actions fail to sufficient...

PT-2026-106707

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-106496: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types...

WS-2026-0154

@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.87.1 and 4.0.0-canary.0 through 4.0.0-canary.30: the MCP login tool let the caller set showHiddenFields and overrideAccess on 3.x, so login responses could return hidden fields such as credential data GHSA-jjm7-864w-gg8q...

@frogbotai/plugin-mcp (>=0.14.0, <=0.23.0), @justanarthur/payload-www (>=1.0.1, <=2.2.6) +1 more potentially affected by unknown CVE via @payloadcms/plugin-mcp (>=3.85.0, <=3.88.0)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0153...

CVE-2026-105864: Incorrect Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection...

CVE-2026-106461: Incorrect Authorization

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

PT-2026-107118

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and A...

PT-2026-107299

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package may expose sensitive information within Scaffolder task failure events. An authenticated user can retrieve backend-managed credentials used during...

PT-2026-107304

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissio...

CVE-2026-106506: Exposure of Sensitive Information Through Data Queries

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106456: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...