2980 matches found
EUVD-2026-93990
Backstage: Insufficient audience validation in the Cloudflare Access auth provider...
@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)
@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...
Improper Verification of Cryptographic Signature
Overview @backstage/plugin-auth-backend-module-cloudflare-access-provider is a The cloudflare-access-provider backend module for the auth plugin. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwtVerify call in helpers.ts, which verifi...
CVE-2026-107221
creationtimestamp| type| source ---|---|--- 2026-10-07 19:53:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i5smj5dsbzi2n 2026-10-07 20:23:08+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-8mcq-6wmr-jrjv...
CVE-2026-106457
A flaw was found in the Backstage Cloudflare Access authentication provider module. This vulnerability allows an attacker to gain unauthorized access to the Backstage application. The provider verifies a token's signature and team issuer but fails to confirm that the token was issued for the...
100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure
Over 100 hacked Ukrainian websites used fake Cloudflare checks to install Lunex Stealer and steal browser passwords, tokens and cryptocurrency wallets...
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine CERT-UA has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer aka Psychedelic Stealer. The activity, which was observed by the agency in...
CVE-2026-106457
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...
CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...
CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...
CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...
CVE-2026-106457
The @backstage/plugin-auth-backend-module-cloudflare-access-provider package (versions >=0.1.6-next.2 and
@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)
@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...
CVE-2026-106457
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...
CVE-2026-39749
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-39749
The WordPress App for Cloudflare® plugin versions
EUVD-2026-93258
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-39749 WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-39749 WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in App for Cloudflare® = 1.10.1 versions...
CVE-2026-106457: Improper Authentication
Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...