172702 matches found
CVE-2026-106491 Backstage: Improper input validation in proxy-backend
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...
CVE-2026-106491 Backstage: Improper input validation in proxy-backend
Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...
CVE-2026-106491
The Backstage framework, an open framework for building developer portals, is vulnerable to improper input validation within the @backstage/plugin-proxy-backend package in versions prior to 0.6.17 . An authenticated user can craft a request URL that forces the proxy-backend to forward requests to...
CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to re...
CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able ...
CVE-2026-105812
The Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14 is vulnerable to a code injection flaw (CWE-94) within its agent import functionality. The root cause is the lack of safe literal encoding for configuration values when generating Python source code. An authenticated same-account ...
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...
CVE-2026-106462
The Backstage open framework for building developer portals is vulnerable in versions prior to 1.54.6 . The scaffolder source-control actions may fail to consistently enforce intended credential boundaries, potentially allowing an authenticated user to trigger an action that falls back to broader...
CVE-2026-106462
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...
CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...
CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operation...
CVE-2026-106461
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...
CVE-2026-106459
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may caus...
CVE-2026-106459
The Backstage framework is affected by an improper input validation vulnerability in the @backstage/plugin-scaffolder-backend-module-sentry package, specifically within sentry scaffolder actions . Versions 0.3.0 through 0.3.8 are impacted. An authenticated internal user capable of executing these...
CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may caus...
CVE-2026-96404
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-79810
Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the...
CVE-2026-79812
A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service...