[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104050 | 7 Oct 2026 | CVSS 4.3 | Unknown Academy LMSThe Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access… | |
| CVE-2026-104651 | 7 Oct 2026 | CVSS 4.3 | Unknown Yaad Sarig Payment Gateway For WCThe Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order… | |
| CVE-2026-104652 | 7 Oct 2026 | CVSS 6.8 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag… | |
| CVE-2026-103868 | 7 Oct 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later… | |
| CVE-2026-103869 | 7 Oct 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for… | |
| CVE-2026-103870 | 7 Oct 2026 | CVSS 5.0 | Red Hat Satellite 6A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can… | |
| CVE-2026-59346 | 7 Oct 2026 | CVSS 9.3 | VMware WorkstationVMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine… | |
| CVE-2026-59347 | 7 Oct 2026 | CVSS 8.1 | VMware WorkstationVMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on… | |
| CVE-2026-102173 | 7 Oct 2026 | CVSS 7.2 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration… | |
| CVE-2026-19572 | 7 Oct 2026 | CVSS 9.3 | Flexera FlexNet PublisherA security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded… | |
| CVE-2026-84897 | 7 Oct 2026 | CVSS 5.3 | wolfSSL Inc. wolfSSHsrc/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and… | Fix |
| CVE-2026-81535 | 7 Oct 2026 | CVSS 9.1 | wolfSSL Inc. wolfSSHIn wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy… | Fix |
| CVE-2026-83540 | 7 Oct 2026 | CVSS 8.8 | wolfSSL wolfSSHWhen password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated… | Fix |
| CVE-2026-83742 | 7 Oct 2026 | CVSS 8.8 | wolfSSL Inc. wolfSSHUnsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an… | Fix |
| CVE-2026-14911 | 7 Oct 2026 | CVSS 9.3 | ASUS RouterImproper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM… | |
| CVE-2026-16516 | 7 Oct 2026 | CVSS 7.4 | wolfSSL Inc. wolfSSHwolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In… | Fix |
| CVE-2026-106061 | 7 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using… | |
| CVE-2026-19396 | 7 Oct 2026 | CVSS 7.7 | ASUS RouterA predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an… | |
| CVE-2026-105324 | 7 Oct 2026 | CVSS 9.2 | ASUSTOR Inc. ADMAn HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host… | |
| CVE-2026-106471 | 7 Oct 2026 | CVSS 8.1 | Red Hat Satellite 6A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is… | |
| CVE-2026-16528 | 7 Oct 2026 | CVSS 8.4 | ASUS RouterInsertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from… | |
| CVE-2026-19386 | 7 Oct 2026 | CVSS 9.3 | ASUS RouterA stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration… | |
| CVE-2026-102478 | 7 Oct 2026 | CVSS 8.7 | Octopus Deploy Octopus ServerIn affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse… | |
| CVE-2026-97673 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. | |
| CVE-2026-97674 | 7 Oct 2026 | CVSS 8.1 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of… | |
| CVE-2026-97676 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special… | |
| CVE-2026-97678 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. | |
| CVE-2026-97679 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special… | |
| CVE-2026-97680 | 7 Oct 2026 | CVSS 8.3 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to… | |
| CVE-2026-93449 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code… | |
| CVE-2026-93674 | 7 Oct 2026 | CVSS 9.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used… | |
| CVE-2026-93675 | 7 Oct 2026 | CVSS 9.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | |
| CVE-2026-93677 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive… | |
| CVE-2026-93678 | 7 Oct 2026 | CVSS 7.6 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. | |
| CVE-2026-93679 | 7 Oct 2026 | CVSS 4.3 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource… | |
| CVE-2026-97655 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security… | |
| CVE-2026-97671 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal… | |
| CVE-2026-103360 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a… | |
| CVE-2026-104334 | 7 Oct 2026 | CVSS 9.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |
| CVE-2026-88962 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code… | |
| CVE-2026-93443 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special… | |
| CVE-2026-93445 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of… | |
| CVE-2026-93447 | 7 Oct 2026 | CVSS 7.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious… | |
| CVE-2026-93448 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a… | |
| CVE-2026-101331 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected… | |
| CVE-2026-101329 | 7 Oct 2026 | CVSS 6.5 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control. | |
| CVE-2026-80048 | 7 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a… | |
| CVE-2026-104335 | 7 Oct 2026 | CVSS 8.8 | IBM Langflow OSSIBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control. | |
| CVE-2026-106583 | 7 Oct 2026 | CVSS 7.8 | OpenBSD OpenSSHIn ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | |
| CVE-2026-97626 | 6 Oct 2026 | CVSS 4.3 | GiteaRequesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header… | |
| CVE-2026-65122 | 6 Oct 2026 | CVSS 5.5 | NVIDIA TensorRTNVIDIA TensorRT contains a vulnerability where an attacker can cause an out of bounds read. A successful exploit of this vulnerability may lead to… | |
| CVE-2026-65142 | 6 Oct 2026 | CVSS 7.8 | NVIDIA Model-OptimizerNVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this… | |
| CVE-2026-86684 | 6 Oct 2026 | CVSS 7.1 | GiteaThe Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with… | Fix |
| CVE-2026-89182 | 6 Oct 2026 | CVSS 5.4 | GiteaWith `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false`… | Fix |
| CVE-2026-96594 | 6 Oct 2026 | CVSS 6.1 | GiteaThe Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to… | Fix |
| CVE-2026-97208 | 6 Oct 2026 | CVSS 4.9 | GiteaThe Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and… | Fix |
| CVE-2026-106507 | 6 Oct 2026 | CVSS 6.5 | backstageBackstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs… | Fix |
| CVE-2026-106508 | 6 Oct 2026 | CVSS 6.5 | Backstage has potential file exposure through local TechDocs publisherBackstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential… | Fix |
| CVE-2026-106509 | 6 Oct 2026 | CVSS 8.8 | Backstage: Improper validation of MkDocs theme configuration in TechDocsBackstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper… | Fix |
| CVE-2026-106587 | 6 Oct 2026 | CVSS 3.3 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a… | |
| CVE-2026-106588 | 6 Oct 2026 | CVSS 3.1 | OpenBSD OpenSSHIn sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. | |
| CVE-2026-106589 | 6 Oct 2026 | CVSS 2.9 | OpenBSD OpenSSHIn sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This… | |
| CVE-2026-106500 | 6 Oct 2026 | CVSS 8.5 | Backstage: Improper task state validation in Scaffolder backendBackstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend… | Fix |
| CVE-2026-106501 | 6 Oct 2026 | CVSS 9.6 | Backstage: Sensitive information exposure in ScaffolderBackstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend… | Fix |
| CVE-2026-106502 | 6 Oct 2026 | CVSS 5.3 | Backstage may expose sensitive information in Scaffolder task failure eventsBackstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose… | Fix |
| CVE-2026-106503 | 6 Oct 2026 | CVSS 8.1 | Backstage: Scaffolder action input authorization bypassBackstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend… | Fix |
| CVE-2026-106504 | 6 Oct 2026 | CVSS 6.5 | Backstage has sensitive information exposure in scaffolder task logsBackstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by… | Fix |
| CVE-2026-106505 | 6 Oct 2026 | CVSS 8.5 | Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backendBackstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by… | Fix |
| CVE-2026-106506 | 6 Oct 2026 | CVSS 5.3 | Backstage has improper input validation in scaffolder task list orderingBackstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by… | Fix |
| CVE-2026-106496 | 6 Oct 2026 | CVSS 6.5 | Backstage: Inconsistent enforcement of allowed location types during catalog processingBackstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by… | Fix |
| CVE-2026-106497 | 6 Oct 2026 | CVSS 4.3 | backstageBackstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by… | Fix |
| CVE-2026-106498 | 6 Oct 2026 | CVSS 7.7 | Backstage: Improper URL validation in catalog entity placeholder resolutionBackstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend… | Fix |
| CVE-2026-106499 | 6 Oct 2026 | CVSS 4.9 | Backstage: Secret-derived values may be exposed in scaffolder task logsBackstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose… | Fix |
| CVE-2026-105267 | 6 Oct 2026 | CVSS 8.1 | GiteaThe Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with… | Fix |
| CVE-2026-105268 | 6 Oct 2026 | CVSS 4.3 | GiteaThe Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that… | Fix |
| CVE-2026-104633 | 6 Oct 2026 | CVSS 6.5 | GiteaWhen migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated… | Fix |
| CVE-2026-101023 | 6 Oct 2026 | CVSS 9.1 | GiteaGitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a… | Fix |
| CVE-2026-19029 | 6 Oct 2026 | CVSS 6.8 | The HDF Group HDF5A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service… | |
| CVE-2026-43598 | 6 Oct 2026 | CVSS 7.7 | AMD Instinct™ MI210Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker… | |
| CVE-2026-106553 | 6 Oct 2026 | CVSS 7.5 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | |
| CVE-2026-106555 | 6 Oct 2026 | CVSS 7.5 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | |
| CVE-2026-106582 | 6 Oct 2026 | CVSS 3.7 | OpenBSD OpenSSHIn sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing… | |
| CVE-2026-106584 | 6 Oct 2026 | CVSS 3.3 | OpenBSD OpenSSHIn ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a… | |
| CVE-2026-106585 | 6 Oct 2026 | CVSS 6.5 | OpenBSD OpenSSHIn sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed… | |
| CVE-2026-106586 | 6 Oct 2026 | CVSS 4.3 | OpenBSD OpenSSHIn sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different… | |
| CVE-2026-106491 | 6 Oct 2026 | CVSS 6.4 | Backstage: Improper input validation in proxy-backendBackstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper… | Fix |
| CVE-2026-106492 | 6 Oct 2026 | CVSS 6.5 | Backstage: Improper preservation of access restrictions during service credential delegationBackstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by… | Fix |
| CVE-2026-106493 | 6 Oct 2026 | CVSS 4.1 | Backstage: Cloud storage catalog locations may cross configured storage boundariesBackstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object… | Fix |
| CVE-2026-106494 | 6 Oct 2026 | CVSS 4.9 | Backstage: Improper input validation in cloud storage URL readersBackstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input… | Fix |
| CVE-2026-106547 | 6 Oct 2026 | CVSS 8.5 | The HDF Group HDF5A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly… | |
| CVE-2026-106550 | 6 Oct 2026 | CVSS 7.5 | Mozilla Node-convictMozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution… | |
| CVE-2026-106552 | 6 Oct 2026 | CVSS 6.5 | OpenBSD OpenSSHIn sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive… | |
| CVE-2026-106462 | 6 Oct 2026 | CVSS 6.4 | Backstage's scaffolder credential handling may allow unintended GitHub authentication fallbackBackstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce… | Fix |
| CVE-2026-106463 | 6 Oct 2026 | CVSS 5.4 | Backstage has improper authorization in GitLab organizational user ingestionBackstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is… | Fix |
| CVE-2026-106486 | 6 Oct 2026 | CVSS 8.5 | Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actionsBackstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and… | Fix |
| CVE-2026-106487 | 6 Oct 2026 | CVSS 5.0 | Backstage: Unsupported catalog cluster authentication mode in kubernetes backendBackstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by… | Fix |
| CVE-2026-106488 | 6 Oct 2026 | CVSS 8.1 | Backstage: Improper authentication in the OIDC providerBackstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is… | Fix |
| CVE-2026-106489 | 6 Oct 2026 | CVSS 6.5 | Backstage: Improper authorization enforcement for TechDocs static contentBackstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper… | Fix |
| CVE-2026-106490 | 6 Oct 2026 | CVSS 6.5 | Backstage: Improper input validation in TechDocs static content requestsBackstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper… | Fix |
| CVE-2026-106457 | 6 Oct 2026 | CVSS 6.8 | Backstage: Insufficient audience validation in the Cloudflare Access auth providerBackstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the… | Fix |
Page 107 of 168