295370 matches found
@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)
@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: OSV:GHSA-GP6M-X9VW-5C5X...
EUVD-2026-94000
Backstage has improper authorization in GitLab organizational user ingestion...
Incorrect Authorization
Overview @backstage/plugin-catalog-backend-module-gitlab is an A Backstage catalog backend module that helps integrate towards GitLab Affected versions of this package are vulnerable to Incorrect Authorization via the GitlabOrgDiscoveryEntityProvider when handling usercreate webhook events, where...
@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)
@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: SNYK:JS-BACKSTAGEPLUGINCATALOGBACKENDMODULEGITLAB-20826430...
GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...
@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: GHSA-G8RX-F7M5-7794...
EUVD-2026-94003
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...
@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...
@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: SNYK:JS-BACKSTAGEPLUGINSCAFFOLDERBACKENDMODULEBITBUCKETSERVER-20825501...
Symlink Attack
Overview @backstage/plugin-scaffolder-backend-module-bitbucket-cloud is a The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...
Symlink Attack
Overview @backstage/plugin-scaffolder-backend-module-bitbucket-server is a The Bitbucket Server module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...
@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20240207020916, <=3.1.3-next.2), @backstage/plugin-scaffolder-backend-module-bitbucket (>=0.0.0-nightly-20240207020916, <=0.3.20-next.0) potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-server (>=0.0.0-nightly-20240929023448, <=0.2.19-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-server NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.3.20-next.0 Source cves: CVE-2026-106486 Source advisory: OSV:GHSA-G8RX-F7M5-7794...
@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +55 more potentially affected by CVE-2026-106486 via @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (>=0.0.0-nightly-20240929023448, <=0.3.4-next.0)
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20240207020916, =0.0.0-nightly-20240207020916, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =0.1.14 -...
EUVD-2026-94005
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via CatalogClusterLocator in...
@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106487 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)
@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106487 Source advisory: GHSA-H53X-HJX6-25GR...
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...
@backstage/plugin-kubernetes (>=0.0.0-nightly-202010102951, <=0.4.2), @devangelista/backstage-scaffolder-kubernetes (>=0.4.0, <=0.5.0) +3 more potentially affected by CVE-2026-106487 via @backstage/plugin-kubernetes-backend (>=0.0.0-nightly-20261031021925, <=0.20.4)
@backstage/plugin-kubernetes-backend NPM version =0.0.0-nightly-20261031021925, =0.0.0-nightly-202010102951, =0.4.0, =1.0.0, =1.1.0, =1.15.1, =2.9.1 Source cves: CVE-2026-106487 Source advisory: SNYK:JS-BACKSTAGEPLUGINKUBERNETESBACKEND-20825509...
GHSA-H53X-HJX6-25GR Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...