Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.4 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.4 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.4 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.4 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

@vrabbi/backstage-devtools-wrapper (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities (0.1.4)

@backstage/plugin-catalog-unprocessed-entities NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-unprocessed-entities and may be impacted: - @vrabbi/backstage-devtools-wrapper =0.2.0, =0.2.1 Source cves:...

@backstage/plugin-catalog-backend-module-unprocessed (>=0.0.0-nightly-20240321021124, <=0.6.10), @backstage/plugin-catalog-unprocessed-entities (>=0.0.0-nightly-20251203024610, <=0.2.29) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities-common (>=0.0.0-nightly-20241116023418, <=0.0.14-next.0)

@backstage/plugin-catalog-unprocessed-entities-common NPM version =0.0.0-nightly-20241116023418, =0.0.0-nightly-20240321021124, =0.0.0-nightly-20251203024610, =0.2.29 Source cves: CVE-2026-44374 Source advisory: OSV:GHSA-P7G9-RP3G-MGFG...

BIT-VAULT-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

CVE-2025-6000

CVE-2025-6000 affects HashiCorp Vault where a privileged Vault operator in the root namespace with write access to {{sys/audit}} can trigger code execution on the host via a misconfigured plugin directory. Connected advisories corroborate the root-namespace operator scenario and the plugin-direct...

CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

CVE-2024-45815

A flaw was found in the backstage/plugin-catalog-backend package. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Mitigation Mitigation for this issue...

@backstage/plugin-catalog-backend Prototype Pollution vulnerability

Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Patches This has been fixed in the 1.26.0 release of the @backstage/plugin-catalog-backend...

CVE-2024-45815 Prototype pollution in @backstage/plugin-catalog-backend

Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the 1.26.0 relea...

WordPress Plugin Product Catalog Simple 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

@janus-idp/backstage-plugin-keycloak-backend (1.0.0) potentially affected by CVE-2023-25571 via @backstage/plugin-catalog-backend (1.5.1)

@backstage/plugin-catalog-backend NPM version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-backend and may be impacted: - @janus-idp/backstage-plugin-keycloak-backend 1.0.0 Source cves: CVE-2023-25571 Source advisory:...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by unknown CVE via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.11.15)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-2021102622333, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32660 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32660 Source advisory: OSV:GHSA-PWHF-39XG-4RXW...

@backstage/plugin-catalog (>=0.0.0-nightly-202011242419, <=0.2.9), @backstage/plugin-techdocs (>=0.0.0-nightly-202011132190, <=0.7.0) +2 more potentially affected by CVE-2021-32662 via @backstage/techdocs-common (>=0.0.0-nightly-20220923026, <=0.5.1)

@backstage/techdocs-common NPM version =0.0.0-nightly-20220923026, =0.0.0-nightly-202011242419, =0.0.0-nightly-202011132190, =0.0.0-nightly-202011132190, =0.0.0-nightly-202111222339, =0.3.5 Source cves: CVE-2021-32662 Source advisory: OSV:GHSA-PGF8-28GG-VPR6...

Wordpress Plugin Catalog HTML Code Injection and Cross-site scripting

Spider WordPress Product Catalog plugin is a convenient tool for organizing the products represented on your website into catalogs. Each product on the catalog is assigned with a relevant category, which makes it easier for the customers to search and identify the needed products within the...