CVE-2026-106312

Missing authorization in SignIn in Google Chrome prior to 155.0.8059.3...

CVE-2026-106323

Missing authorization in Chrome for iOS in Google Chrome on on iOS pri...

CVE-2026-106503

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2023-23752

CVE-2023-23752 Descripción Este repositorio contiene scripts en Python y Bash que sirven como portaciones del Prueba de Concepto PoC original escrita en Ruby para la vulnerabilidad CVE-2023-23752 en Joomla! CMS versiones 4.0.0 hasta 4.2.7 realizada por 'noraj' Alexandre ZANNI. Se identificó una...

CVE-2026-106503

The Backstage framework's @backstage/plugin-scaffolder-backend package is vulnerable to a scaffolder action input authorization bypass in versions prior to 3.3.1, 3.4.1, 4.0.3, and 4.1.0. An authenticated user with access to affected Scaffolder templates can bypass configured action restrictions....

CVE-2026-106503 Backstage: Scaffolder action input authorization bypass

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106503 Backstage: Scaffolder action input authorization bypass

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463

The Backstage framework is vulnerable to improper authorization in the @backstage/plugin-catalog-backend-module-gitlab package prior to version 0.8.7 . The flaw occurs during GitLab organizational user ingestion ; deployments enabling GitLab organization event ingestion that rely on scoped catalo...

AZL-106655 CVE-2026-76061 affecting package cri-o 1.30.1-1

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...

CVE-2026-76743

A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an...

CVE-2026-76061

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...

DEBIAN-CVE-2026-104048

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

USN-8892-1: Ubuntu Pro for WSL vulnerability

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories...

EUVD-2026-93942

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2026-76061

A flaw in CRI-O 's bind_mount_prefix handling allows a malicious container or local attacker to bypass prefix restrictions. By using a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink, an attacker can cause the bind mount source to resolve outside the intende...

EUVD-2026-93915

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...