@beejiujitsu/backstage-plugin-glean-backend (>=1.0.0, <=1.0.2), @roadiehq/backstage-plugin-glean-backend (1.0.1) potentially affected by CVE-2026-106490 via @backstage/plugin-techdocs-backend (1.11.6)

@backstage/plugin-techdocs-backend NPM version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-backend and may be impacted: - @beejiujitsu/backstage-plugin-glean-backend =1.0.0, =1.0.2 -...

@beejiujitsu/backstage-plugin-glean-backend (>=1.0.0, <=1.0.2), @roadiehq/backstage-plugin-glean-backend (1.0.1) potentially affected by CVE-2026-106489 via @backstage/plugin-techdocs-backend (1.11.6)

@backstage/plugin-techdocs-backend NPM version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-backend and may be impacted: - @beejiujitsu/backstage-plugin-glean-backend =1.0.0, =1.0.2 -...

GHSA-J8F7-X8JM-WMM4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Summary Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses...

CVE-2026-54339

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54339

Glean , a self-hosted RSS reader and personal knowledge management tool, is affected by a non-blind SSRF with full response disclosure in versions prior to 0.2.6 . An attacker who can POST a malicious feed URL to /api/feeds/discover causes the background worker to fetch each item link without net...

CVE-2026-54339 Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54339 Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54339 Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54339

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

EUVD-2026-82429

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54339: Server-Side Request Forgery (SSRF)

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

PT-2026-95100

Name of the Vulnerable Software and Affected Versions Glean versions prior to 0.2.6 Description An issue exists where the application fails to perform network-level validation on URLs provided in RSS feeds. When a user submits a feed url via the 'POST /api/feeds/discover' endpoint, the system...

Malicious code in glean-indexing-api-client (PyPI)

Source: kam193 c4f72985a496d7f564761c6862c160db30daaa442596d1cb609b0cc750bfad7a Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data exfiltration including all env variables and potential remote code...

astra-assistants (>=2.3.0, <=2.4.5), fiftyone-mcp-server (>=0.1.0, <=0.1.2) +7 more potentially affected by CVE-2026-59950 via mcp (0.9.1)

mcp PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mcp and may be impacted: - astra-assistants =2.3.0, =0.1.0, =3.0.16, =0.0.4, =1.0.26, =1.0.35 Source cves: CVE-2026-59950 Source advisory: OSV:GHSA-VJ7Q-GJH5-988W...

chaste-codegen (>=0.4.0, <=0.10.2), docker-tidy (>=0.1.0, <=0.1.4) +6 more potentially affected by CVE-2024-5569 via zipp (1.2.0)

zipp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - chaste-codegen =0.4.0, =0.1.0, =0.7.10, =1.18.3, =26.0.0, =1.0.4, =1.0.6 - mapyllary 0.0.6 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-20...

Malicious Package

Overview backstage-plugin-glean is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malware in backstage-plugin-glean

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205460

Malicious code in backstage-plugin-glean npm...

MAL-2025-192944 Malicious code in backstage-plugin-glean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824531546cd7527be37fc4aa5ca2020424a1ecf090eaba3a8974105871c0931f The package backstage-plugin-glean was found to contain malicious code. Source: ghsa-malware...