204609 matches found
Security Bulletin:RSCT 3.0 Improper Input Validation Denial of Service Vulnerability
Summary IBM Reliable Scalable Cluster Technology RSCT 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due improper input validation. Vulnerability Details CVEID:CVE-2026-14514 DESCRIPTION: IBM Reliable Scalable Cluster Technology RSCT 3.0 coul...
Security Bulletin:UltraJSON Malformed UTF-8 Byte Sequence Vulnerability
Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into...
GHSA-75QF-886X-5XF2 Backstage: Improper input validation in Confluence to Markdown scaffolder module
Impact Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content. Patches Patche...
Backstage: Improper input validation in Confluence to Markdown scaffolder module
Impact Insufficient input validation in the Confluence to Markdown scaffolder module could allow an attacker to influence file write operations during template execution. Exploitation requires a Backstage user to run a template that processes attacker-influenced Confluence content. Patches Patche...
GHSA-2CMG-V53W-8XFP Backstage: Improper repository path validation in a Scaffolder backend module
Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...
Backstage: Improper repository path validation in a Scaffolder backend module
Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...
GHSA-R9PH-3637-55PX Backstage: Improper entity validation in deprecated Kubernetes services endpoint
Impact An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured cluster...
GHSA-G8RX-F7M5-7794 Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...
EUVD-2026-94009
Backstage: Improper input validation in TechDocs static content requests...
GHSA-7MFX-XG57-53C9 Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...
Backstage: Improper input validation in TechDocs static content requests
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched...
EUVD-2026-94013
Backstage: Cloud storage catalog locations may cross configured storage boundaries...
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Impact Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials...
EUVD-2026-94010
Backstage: Improper input validation in proxy-backend...
Backstage: Improper input validation in proxy-backend
Impact An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by...
GHSA-9GHW-48H5-V2W5 Backstage: Improper input validation in proxy-backend
Impact An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by...
EUVD-2026-94015
Backstage: Improper input validation in cloud storage URL readers...
Backstage: Improper input validation in cloud storage URL readers
Impact An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection. Patches Patched in @backstage/backend-defaults...