@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-88064 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-88064 Source advisory: MEND:CVE-2026-88064...

CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

EUVD-2026-80784

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-88064

Backstage is an open-source framework for building developer portals. The @backstage/plugin-techdocs-node package, prior to 1.14.6 and from 1.15.0 until 1.15.4, insufficiently validates mkdocs.yml files supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python ...

CVE-2026-88064

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which "named" treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

DEBIAN-CVE-2026-89982

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...

CVE-2026-89982

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...

DEBIAN-CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89832

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

DEBIAN-CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

CVE-2026-90041

CVE-2026-90041 is a use-after-free vulnerability in the Linux kernel's HID Sony driver (hid-sony). When input_register_device() fails after sony_input_configured() has already linked a controller to sony_device_list, the probe unwind path frees the devres-managed sony_sc structure while its list ...

CVE-2026-89982 i2c: mux: Fix channel node leak on adapter add failure

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...

CVE-2026-89982 i2c: mux: Fix channel node leak on adapter add failure

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: Fix channel node leak on adapter add failure i2cmuxaddadapter takes a reference to the Device Tree channel node before registering the new adapter. If adapter registration fails, the error path frees the private data...

CVE-2026-89982

This Linux kernel vulnerability affects the I2C mux subsystem. In i2c_mux_add_adapter(), a reference to the Device Tree channel node is taken before registering the new adapter; if registration fails, the error path frees the private data without dropping that reference , causing a node leak . Th...

CVE-2026-89832 f2fs: fix to clear dirty flag on folio in error path

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...

CVE-2026-89832

CVE-2026-89832 affects the f2fs filesystem in the Linux kernel . The root cause is that when a node block is corrupted due to a checksum mismatch or inconsistent footer info, the dirty flag on the node folio was not properly cleared in the error path, causing inconsistent node data to be persiste...