PT-2026-107310

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Description The @backstage/plugin-techdocs-node package fails to properly validate the mkdocs theme configuration. When TechDocs is configured to build documentation locally or within a container, an attacker...

CVE-2026-106455: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

PT-2026-107305

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package allows potential file exposure when the local TechDocs publisher is used via the techdocs.publisher.type variable set to 'local'. In this configuration,...

PT-2026-107263

Name of the Vulnerable Software and Affected Versions Backstage versions 0.3.0 through 0.6.14 Backstage versions 0.7.0 through 0.7.4 Description The @backstage/plugin-auth-node package fails to consistently honor explicit negative email verification during shared OAuth profile normalization. This...

CVE-2026-106508: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

PT-2026-107244

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions 0.11.12 through 1.14.6 @backstage/plugin-techdocs-node versions 1.15.0 through 1.15.4 Description Improper validation of mkdocs plugin configuration in techdocs allows an authenticated attacker with...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

PT-2026-107304

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissio...

PT-2026-107250

Name of the Vulnerable Software and Affected Versions Node-convict versions 6.2.2 and later Description Incomplete prototype pollution protections in the config.set function allow an attacker who controls the configuration key to write arbitrary properties to constructor.. The walk function...

@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)

@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: GHSA-6VC5-VF29-FFR2...

@nx/express (>=23.0.0, <=23.1.0), @nx/nest (>=23.0.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0)

@nx/docker NPM version =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

Malicious Package

Overview dzyclutch-libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dzyclutch-libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17621 Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

Malicious code in @abgular/core (npm)

Source: amazon-inspector 4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b Package name @abgular/core is a single-character transposition of @angular/core and copies that package's description, author, and repository metadata. The package.json declares a postinstall script that run...

[SECURITY] [DLA 4820-1] node-lodash security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 05, 2026 https://wiki.debian.org/LTS -...