403 matches found
PT-2026-3875
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 @backstage/plugin-scaffolder-backend versions prior to 2.2.2, 3.0.2, and 3.1.1 @backstage/plugin-scaffolder-node versions prior to 0.11.2 and 0.12.3 Description The software is...
PT-2026-3876
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.1.17 Description The resolveSafeChildPath utility function in @backstage/backend-plugin-api did not properly validate symlink chains and dangling symlinks, leading to a path traversal issue. An attacker could bypa...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.8.2 release.
Red Hat Developer Hub 1.8.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
CVE-2021-41151
Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...
Malicious Package
Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Malicious code in backstage-plugin-glean (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-205460
Malicious code in backstage-plugin-glean npm...
MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.8.1 release.
Red Hat Developer Hub 1.8.1 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
EUVD-2025-200119
Gin-vue-admin has an arbitrary file deletion vulnerability...
CVE-2025-66410
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder...
EUVD-2021-2243
Malware in sbrugna...
EUVD-2021-1324
Malware in sbrugna...
EUVD-2021-2600
Malware in sbrugna...
EUVD-2021-2554
Malware in sbrugna...
EUVD-2021-1373
Malware in sbrugna...
EUVD-2024-0471
Malicious code in bioql PyPI...
EUVD-2024-2702
Malicious code in bioql PyPI...