CVE-2026-6815

CVE-2026-6815 PoC/Exploit: Casdoor 3.54.1 Path Traversal & Arbitrary File Write Authenticated This repository contains a Proof of Concept PoC exploit for CVE-2026-6815, an arbitrary file write and path traversal vulnerability in Casdoor. The vulnerability has been fixed in version 3.54.1...

CVE-2026-88140

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

CVE-2026-69506

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

CVE-2026-69506

The Windows Key Storage Provider is vulnerable to an out-of-bounds read (CWE-125). This vulnerability allows an authorized attacker to disclose information locally . The vulnerability is assigned a CVSS 3.1 base score of 4.7 (Medium) , characterized by a LOCAL attack vector and HIGH confidentiali...

CVE-2026-88140

An out-of-bounds read vulnerability exists in the Windows Key Storage Provider . This flaw allows an authorized attacker to perform a local information disclosure by reading data outside of the intended memory boundaries. The vulnerability is assigned a CVSS 3.1 base score of 5.5 (Medium) with a ...

Windows Key Storage Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

Windows Key Storage Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

CVE-2026-88140: Out-of-bounds Read

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-88140: Windows Key Storage Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

PT-2026-112951

Name of the Vulnerable Software and Affected Versions Windows Key Storage Provider affected versions not specified Description An out-of-bounds read occurs in the Windows Key Storage Provider, which allows an authorized attacker to disclose sensitive information locally. Recommendations At the...

PT-2026-112057

Name of the Vulnerable Software and Affected Versions Windows Key Storage Provider affected versions not specified Description An out-of-bounds read occurs in the Windows Key Storage Provider, which allows an authorized attacker to disclose sensitive information locally...

CVE-2026-69506: Out-of-bounds Read

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

Microsoft Windows: CVE-2026-69506: Windows Key Storage Provider Information Disclosure Vulnerability

Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally...

CVE-2026-106490

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...

CVE-2026-106489

The Backstage framework is vulnerable in the @backstage/plugin-techdocs-backend package prior to version 2.2.4 due to improper authorization enforcement for TechDocs static content. An authenticated user with access to one documentation site can craft a URL to read documentation belonging to a di...

CVE-2026-106489

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...

PT-2026-107270

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 2.2.4 Description The @backstage/plugin-techdocs-backend package contains improper authorization enforcement for static content. An authenticated user with access to one TechDocs documentation site can craft a URL t...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in LDAPStorageProvider.searchLDAPByAttributes through LDAPENTRYDN lookups in federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java. A delegated administrator can retrieve and import...

CVE-2026-16071: Improper Neutralization of Special Elements used in an LDAP Query

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...