926 matches found
CVE-2026-106495 Backstage: Improper access control in backend action invocation
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20260521032220, <=0.8.7-next.0), @backstage/backend-test-utils (>=1.11.3-next.0, <=1.11.6-next.1) +9 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.17.1-next.0, <=0.17.7)
@backstage/backend-defaults NPM version =0.17.1-next.0, =0.0.0-nightly-20260521032220, =1.11.3-next.0, =0.0.0-nightly-20260820023416, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260521032220, =0.0.0-nightly-20260521032220, =0.4.22-next.0, =0.3.11-next.0, =8.0.0,...
CVE-2026-106495 Backstage: Improper access control in backend action invocation
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
CVE-2026-106495
The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...
Important: tomcat-native
Issue Overview: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be...
PT-2026-110908
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper access control regarding backend action invocation. This allows an authenticated user to trigger actions that an operator specifically...
Amazon Linux 2023 : tomcat-native (ALAS2023-2026-3167)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3167 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0...
CVE-2026-106495: Improper Access Control
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
EUVD-2026-43176
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure...
Directory Traversal
Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path segments are not validated for...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +304 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory:...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +304 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory: OSV:GHSA-XVH9-35W9-42M4...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +304 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory: GHSA-XVH9-35W9-42M4...
EUVD-2026-94012
Backstage: Improper preservation of access restrictions during service credential delegation...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +304 more potentially affected by CVE-2026-106492 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106492 Source advisory: GHSA-CQ7V-RFGC-5C7V...
Incorrect Authorization
Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Incorrect Authorization via the service credential delegation path in DefaultAuthService, when a token issued to an external service principal carries acce...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20260521032220, <=0.8.7-next.0), @backstage/backend-test-utils (>=1.11.3-next.0, <=1.11.6-next.1) +9 more potentially affected by CVE-2026-106492 via @backstage/backend-defaults (>=0.17.1-next.0, <=0.17.7)
@backstage/backend-defaults NPM version =0.17.1-next.0, =0.0.0-nightly-20260521032220, =1.11.3-next.0, =0.0.0-nightly-20260820023416, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260521032220, =0.0.0-nightly-20260521032220, =0.4.22-next.0, =0.3.11-next.0, =8.0.0,...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +304 more potentially affected by CVE-2026-106492 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106492 Source advisory: OSV:GHSA-CQ7V-RFGC-5C7V...
@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +296 more potentially affected by CVE-2026-106492 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.16.1-next.2)
@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106492 Source advisory:...