@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)

@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: GHSA-GP6M-X9VW-5C5X...

@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)

@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: OSV:GHSA-GP6M-X9VW-5C5X...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: OSV:GHSA-G8RX-F7M5-7794...

EUVD-2026-94003

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: GHSA-G8RX-F7M5-7794...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...

EUVD-2026-94007

Backstage: Improper authentication in the OIDC provider...

GHSA-826H-28H9-65HG Backstage: Improper authentication in the OIDC provider

Impact Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity. This may grant access and permissions associated with that user. No direct availability impact is...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: OSV:GHSA-826H-28H9-65HG...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.24.4-next.2), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2) +1 more potentially affected by CVE-2026-106488 via @backstage/plugin-auth-backend-module-oidc-provider (>=0.0.0-nightly-20240929023448, <=0.4.1-next.2)

@backstage/plugin-auth-backend-module-oidc-provider NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240929023448, =0.2.4-next.2, =0.2.5 Source cves: CVE-2026-106488 Source advisory: GHSA-826H-28H9-65HG...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-azure is an A Backstage catalog backend module that helps integrate towards Azure Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL...

Directory Traversal

Overview @backstage/plugin-catalog-backend-module-aws is an A Backstage catalog backend module that helps integrate towards AWS Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path...

DRUPAL-CONTRIB-2026-204

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

CVE-2026-106559

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

CVE-2026-106560

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106562

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

CVE-2026-106562

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

CVE-2026-106562 Backstage: Incorrect authorization in search engine permission filtering

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

EUVD-2026-94375

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...