Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the apiBaseUrl input parameter in the createSentryCreateProjectAction and fetchDSN scaffolder actions, which previously accepted an arbitrary caller-supplied URL without validating it against the...

EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

GHSA-XM5Q-P7W3-X6CP Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +602 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.0.7, =1.1.8, =0.1.8, =0.2.8, =0.2.10 and more Source cves: CVE-2026-106460 Source advisory:...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +602 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.0.7, =1.1.8, =0.1.8, =0.2.8, =0.2.10 and more Source cves: CVE-2026-106460 Source advisory:...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via PassportHelpers.ts in the makeProfileInfo function, which fails to check the verified flag on OAuth profile emails and the emailverified claim in ID tokens before accepting them as...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

EUVD-2026-93995

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...

@backstage/backend-app-api (>=1.7.0-next.0, <=1.7.4-next.1), @backstage/backend-defaults (>=0.0.0-nightly-20260415031804, <=0.17.9-next.1) +113 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.7.0, <=0.7.5-next.1)

@backstage/plugin-auth-node NPM version =0.7.0, =1.7.0-next.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-20260415031804, =0.6.9-next.0, =1.9.1-next.0, =0.0.0-nightly-20260415031804, =0.0.0, =0.5.14-next.0, =0.1.45-next.0, =0.0.0-nightly-20260415031804, =0.4.15-next.0, =0.4.1-next.0,...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.7, <=0.1.12), @alexandreamormino/plugin-entity-manager-backend (>=1.0.1, <=1.0.4) +602 more potentially affected by CVE-2026-106460 via @backstage/plugin-auth-node (>=0.4.17, <=0.6.15-next.0)

@backstage/plugin-auth-node NPM version =0.4.17, =0.1.7, =1.0.1, =0.4.5, =0.4.5, =0.5.5, =0.5.5, =0.3.10, =1.1.5, =1.0.0, =0.1.8, =2.0.6, =1.0.7, =1.1.8, =0.1.8, =0.2.8, =0.2.10 and more Source cves: CVE-2026-106460 Source advisory:...

AZL-107300 CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: GHSA-4488-J8VJ-VQQV...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: OSV:GHSA-4488-J8VJ-VQQV...

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.14-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.8-next.0) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.6-next.0)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.8-next.0 Source cves: CVE-2026-106510 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825498...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825498...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via...