CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-115923

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)

@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

@backstage/backend-dynamic-feature-service (>=0.8.7-next.2, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.8.0-next.1, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.0-next.1, <=4.0.1-next.1)

@backstage/plugin-catalog-backend NPM version =4.0.0-next.1, =0.8.7-next.2, =0.8.0-next.1, =0.1.26-next.1, =0.1.4-next.1, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: MEND:CVE-2026-115923...

CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An...

CVE-2026-116400 WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Adminer CVE-2020-35572 Detect

Detects Adminer database console elasticsearch plugin LFI chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adminer database console elasticsearch plugin LFI chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Security Bulletin: A Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-73633)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-73633 DESCRIPTION: Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate...

Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud is affected by multiple security vulnerabilities.

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid Cloud. The identified vulnerabilities affect OS packages and Go standard library packages and impact the product in the deployed environment. Two of the vulnerabilities are rated high, with...

OPENSUSE-SU-2026:22190-1 Security update for perl-Dancer2-Plugin-Auth-Extensible

This update for perl-Dancer2-Plugin-Auth-Extensible fixes the following issues: Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to 0.713.0 0.713 Fix the ability to generate links in emails that have...

CVE-2026-116516

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

EUVD-2026-109838

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

CVE-2026-116516

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions

Mattermost versions =11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows an authenticated attacker to crash the Agents plugin via summarizing a Zoom chat transcription containing short continuation lines. Mattermost Advisory ID: MMSA-2026-00723...

CVE-2026-116516

Mattermost versions

WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Dokan versions = 5.3.1...

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Zoho Flow versions = 2.14.5...

WordPress Polylang Pro plugin < 3.7.4 - Contributor+ PHP Object Injection vulnerability

Contributor+ PHP Object Injection vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Polylang Pro versions 3.7.4...