46 matches found
CLEANSTART-2024-VI40953 Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)
Security vulnerability affects the grafana-image-renderer package. Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome...
CLEANSTART-2026-WV46306 Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)
Security vulnerability affects the grafana package. Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome...
CVE-2026-106489
A flaw was found in the Backstage TechDocs backend plugin. An authenticated user with access to at least one documentation site can craft a request to bypass access controls when permissions and external storage are enabled. This flaw allows an attacker to view restricted documentation belonging ...
CVE-2026-2975
A security flaw has been discovered in FastApiAdmin up to 2.2.0. Affected by this vulnerability is the function resetapidocs of the file /backend/app/plugin/initapp.py of the component Custom Documentation Endpoint. The manipulation results in information disclosure. The attack may be performed...
[SECURITY] Fedora 43 Update: bind-dyndb-ldap-11.11-10.fc43
This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...
CVE-2026-24047
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
CVE-2026-24047
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
CVE-2026-24047 @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
CVE-2026-24047 @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
CVE-2026-24047
CVE-2026-24047 affects Backstage: @backstage/cli-common relies on resolveSafeChildPath in @backstage/backend-plugin-api, which before v0.1.17 failed to validate symlink chains and dangling symlinks. This allowed path traversal via symlink chains (e.g., link1 → link2 → /outside) and dangling symli...
CVE-2026-24047
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the "resolveSafeChildPath" utility function in "@backstage/backend-plugin-api", whic...
CVE-2026-24047 @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
@backstage/backend-app-api (>=0.0.0-nightly-20241221023113, <=1.4.0-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20241120023536, <=0.15.0-next.2) +111 more potentially affected by CVE-2026-24047 via @backstage/backend-plugin-api (>=1.0.1-next.0, <=1.6.0)
@backstage/backend-plugin-api NPM version =1.0.1-next.0, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.2.0-next.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241121023535, =0.1.26-next.1, =0.0.0-nightly-20250225023230, =0.3.1-next.1,...
@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass
Impact The resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation by: 1. Symlink chains: Creating link1 → link2 → /outsi...
@backstage/backend-app-api (>=0.0.0-nightly-20241221023113, <=1.4.0-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20241120023536, <=0.15.0-next.2) +111 more potentially affected by CVE-2026-24047 via @backstage/backend-plugin-api (>=1.0.1-next.0, <=1.6.0)
@backstage/backend-plugin-api NPM version =1.0.1-next.0, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241120023536, =0.0.0-nightly-20241120023536, =0.2.0-next.1, =0.0.0-nightly-20241221023113, =0.0.0-nightly-20241121023535, =0.1.26-next.1, =0.0.0-nightly-20250225023230, =0.3.1-next.1,...
CVE-2026-24047: Improper Link Resolution Before File Access
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...
PT-2026-3876
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17 Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypa...
EUVD-2021-2600
Malware in sbrugna...