EUVD-2026-93986

Backstage: Improper validation of MkDocs plugin configuration in TechDocs...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=0.11.12, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =0.11.12, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.12-next.0, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

GHSA-472H-9C5J-PRRR Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

EUVD-2026-93989

Backstage: Inconsistent credential enforcement for overlapping proxy routes...

Backstage: Inconsistent credential enforcement for overlapping proxy routes

Impact An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may...

EUVD-2026-93992

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...

EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +594 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.1.8, =0.2.8, =1.0.7, =0.2.6, =0.2.8 and more Source cves: CVE-2026-106460 Source advisory: OS...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +594 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.1.8, =0.2.8, =1.0.7, =0.2.6, =0.2.8 and more Source cves: CVE-2026-106460 Source advisory: GH...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

GHSA-XM5Q-P7W3-X6CP Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

EUVD-2026-93995

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...

AZL-107300 CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...