CVE-2026-106460: Improper Authentication

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email...

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...

PT-2026-107303

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains improper input validation regarding the ordering of scaffolder task lists. An authenticated user with permissions to create and read...

CVE-2026-106496: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types...

PT-2026-106793

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-multi-tenant versions prior to 3.90.0 @payloadcms/plugin-multi-tenant canary versions prior to 4.0.0-canary.34 Description An authenticated user can assign their own account to other tenants due to the default tenant array...

PT-2026-106782

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-ecommerce versions prior to 3.90.0 @payloadcms/plugin-ecommerce versions prior to 4.0.0-canary.34 Description When using the Stripe payment adapter, a Stripe order confirmation can be processed multiple times under certain...

PT-2026-106707

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-105864: Incorrect Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection...

PT-2026-107281

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains an issue regarding inconsistent catalog property permission evaluation. In environments where value-based catalog permission conditions are us...

PT-2026-106752

Name of the Vulnerable Software and Affected Versions Microsoft.OpenApi.Kiota versions 1.25.1 through 1.34.1 Microsoft.OpenApi.Kiota.Builder versions 1.25.1 through 1.34.1 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate the x-ai-capabilities.response...

CVE-2026-104036: Out-of-bounds Write

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to...

PT-2026-107295

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.5.1 Backstage versions prior to 3.6.2 Backstage versions prior to 3.7.2 Backstage versions prior to 3.8.2 Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains improp...

PT-2026-107300

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains an authorization bypass regarding...

PT-2026-107118

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and A...

CVE-2026-106456: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential...

PT-2026-106776

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.87.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.26 Description An unauthenticated user can cause unintended application behavior when the @payloadcms/plugin-import-export plugin is enabled. By...

CVE-2026-105795: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-106458: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the...

CVE-2026-106506: Exposure of Sensitive Information Through Data Queries

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-94299: Incorrect Authorization

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...