Gophish versions through 0.12.1 have a rate limit bypass vulnerability that allows unauthenticated attackers to evade login throttling by spoofing X-Forwarded-For or X-Real-IP headers. This enables attackers to perform unlimited password guessing and credential stuffing attacks against the /login endpoint.
Authenticated OVH email users can manipulate the SMTP envelope 'Envelope-from' and 'From' fields to send emails that appear to originate from any OVH-hosted domain. This is enabled by OVH's default SPF configuration, which authorizes OVH mail servers to send mail on behalf of these domains. As a result, forged messages pass SPF validation despite not being authorized by the domain owner.
LMCache versions through 0.5.5 have an unauthenticated remote code execution vulnerability. Remote attackers can post Python scripts to the /run_script endpoint, exploiting the FastAPI app object to bypass import restrictions and execute arbitrary OS commands as the LMCache process. This vulnerability has a critical CVSS score of 9.8.
LMCache versions through 0.5.5 have a missing authentication vulnerability in the multiprocess mode HTTP server. This flaw allows remote unauthenticated attackers to access management endpoints that listen on all interfaces by default. Attackers can retrieve sensitive environment credentials and configuration data, clear caches, delete cache objects, and modify tenant quotas to evict cached data belonging to other tenants.
Gophish versions up to 0.12.1 have a timing discrepancy vulnerability in the AdminServer.Login function. This flaw allows unauthenticated attackers to enumerate valid usernames by measuring differences in login response times. By submitting usernames to the POST /login endpoint, attackers can detect bcrypt comparison delays indicative of existing accounts. This information can aid attackers in focusing password guessing or credential stuffing attacks. The vulnerability has a medium severity with a CVSS score of 3.7. No patch or remediation details are provided in the available data.
LMCache versions through 0.5.5 have a server-side request forgery (SSRF) vulnerability in the frontend monitoring service. This flaw allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts via a POST request to /api/proxies. Subsequently, attackers can use the /proxy or /proxy2 endpoints to access internal hosts, read their responses, and interfere with node operations or heartbeat signals.
CVE-2026-107218 is a medium severity vulnerability in the Go library excelize (versions 2.10.1 through 2.11.0) used for reading and writing Microsoft Excel spreadsheets. The issue arises from improper validation of array indices in the RIGHT function, which inconsistently uses UTF-16 code-unit counts and Unicode code-point counts when slicing strings. This mismatch can cause a negative index panic during formula evaluation when processing supplementary-plane Unicode characters. No fix is currently available for this vulnerability.
CVE-2026-107217 is an integer overflow vulnerability in the Excelize Go library used for reading and writing Microsoft Excel spreadsheets. The function ColumnNameToNumber does not detect overflow when converting long column names to numeric indices, causing a wraparound to zero. This leads to a negative slice index during worksheet normalization, which can cause the application to panic and terminate unexpectedly. No fixed version is currently available.
A heap-based buffer overflow vulnerability exists in GIMP's Hot color filter plug-in due to an integer overflow when calculating pixel buffer size for very large images. This causes the allocated buffer to be smaller than needed, leading to out-of-bounds memory access when the filter processes pixels based on the actual image size. The vulnerability affects multiple specific versions of GIMP. The CVSS score is 6.3, indicating a medium severity level.
A heap-based buffer overflow vulnerability exists in GIMP's raw data export plug-in. This flaw occurs when exporting very large images due to an integer overflow in memory allocation calculations, leading to insufficient memory allocation and potential memory corruption. The vulnerability has a CVSS score of 6.3, indicating medium severity. It affects multiple specific versions of GIMP as listed. There is no information about available patches or vendor advisories confirming remediation status. No known exploits are reported in the wild.
CVE-2026-56851 is a high severity vulnerability in the golang.org/x/text/secure/precis package. It is an out-of-bounds write issue (CWE-787) affecting versions prior to 0.41.0. The vulnerability can cause denial of service due to application crashes but does not impact confidentiality or integrity.
A remote code execution vulnerability exists in the @backstage/plugin-techdocs-node component due to crafted markdown_extensions in the TechDocs mkdocs.yml file. An authenticated user with permission to register catalog entities can exploit this flaw to execute arbitrary OS commands on the TechDocs build host during documentation builds. The issue is patched in version 1.15.4. Workarounds include switching to an external builder mode, restricting catalog entity registration permissions, and auditing existing mkdocs.yml files for suspicious markdown_extensions entries.
A vulnerability in the @backstage/plugin-techdocs-node package allows an attacker who can supply configuration to a TechDocs build to execute code in the generator runtime. This risk is especially severe if the documentation generation process runs with backend credentials or has host access. The issue is fixed in version 1.15.4. Until patched, it is recommended to generate TechDocs externally in isolated environments without sensitive credentials and to restrict and review configuration changes before generation.
An input validation vulnerability in the Confluence to Markdown scaffolder module of Backstage allows an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template processing attacker-controlled Confluence content. The issue is patched in version 0.3.25 of the plugin.
CVE-2026-106560 is a high-severity vulnerability in the Backstage plugin '@backstage/plugin-scaffolder-backend-module-confluence-to-markdown'. It allows an authenticated user who can execute an affected template and control the repository file location to write generated content outside the intended task workspace, potentially overwriting files in locations writable by the backend process. This improper repository path validation can lead to integrity impact. The issue is patched in version 0.3.25 of the plugin.
An authorization bypass vulnerability exists in the Backstage plugin search backend when permission filtering is enabled and using Elasticsearch or OpenSearch. Authenticated users subject to a DENY policy for certain search document types may receive unauthorized search results. This affects versions of @backstage/plugin-search-backend prior to 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch prior to 1.8.7. A fix is available in these versions.
An improper entity validation vulnerability exists in the deprecated Kubernetes services endpoint of the @backstage/plugin-kubernetes-backend. Authenticated users with Kubernetes read permissions can exploit this flaw to access Kubernetes workload metadata beyond their intended scope. The exposure is limited to read-only access of Kubernetes object metadata across configured clusters. The issue is patched in version 0.21.8 of the plugin. Workarounds include disabling the deprecated endpoint or restricting read permissions.
CVE-2026-106164 is a high-severity vulnerability in Progress Telerik Document Processing SpreadProcessing library versions from 2026.3.811 up to but not including 2026.3.1006. It involves an infinite loop triggered by importing a specially crafted corrupted XLS file, which causes the import timeout to be ignored and results in an unresponsive CPU thread leading to denial of service.
An information disclosure vulnerability exists in the @backstage/plugin-kubernetes-backend prior to version 0.21.9. Authenticated users with Kubernetes resource read permissions could access sensitive data that the plugin is intended to mask, including credentials and confidential information from connected clusters. Exposure is limited to resources accessible by the Backstage service account and matching the targeted namespace and label selectors. The issue is fixed in version 0.21.9, which also improves masking behavior for certain custom resources.
A vulnerability in Backstage's plugin-scaffolder-backend may allow authenticated users to perform source control operations with broader access than intended due to inconsistent enforcement of credential boundaries. This affects scaffolder actions interacting with source control management (SCM) systems. A fix is available in version 4.1.0 and related module versions, introducing an opt-in configuration to enforce user-provided credentials. Until upgraded, restricting task creation and limiting SCM credentials can mitigate risk.