PT-2026-20786

Name of the Vulnerable Software and Affected Versions Slyde versions 0.0.4 and below Description Slyde is a program used to create animated presentations from XML. A remote code execution issue exists because Node.js automatically imports /.plugin.js,mjs files, including those from node modules...

CVE-2026-25153

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...

Arbitrary Code Injection

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Arbitrary Code Injection via the processing of MkDocs hooks, when TechDocs is configured wit...

EUVD-2026-5004

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...

Malicious code in httpeace-node-plugin-upload (npm)

The package httpeace-node-plugin-upload was found to contain malicious code...

MAL-2025-22765 Malicious code in httpeace-node-plugin-upload (npm)

The package httpeace-node-plugin-upload was found to contain malicious code...