261482 matches found
EUVD-2026-93992
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...
EUVD-2026-93993
Backstage: Improper input validation in Sentry scaffolder actions...
GHSA-XM5Q-P7W3-X6CP Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Impact Several Passport-based authentication providers use shared OAuth profile normalization from @backstage/plugin-auth-node. Affected versions may pass an email to email-based sign-in resolvers even when verification metadata supplied for that same address is explicitly negative. The...
EUVD-2026-93995
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization...
AZL-107300 CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8
A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...
Exploit for CVE-2026-105844
CVE-2026-105844 — Payload CMS import-export prototype pollutio...
MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)
tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...
Backstage: Improper validation of TechDocs MkDocs configuration
Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...
GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration
Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...
Backstage: Improper repository path validation in a Scaffolder backend module
Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...
Backstage has incorrect authorization in search engine permission filtering
Impact An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. Patches - Upgrade...
GHSA-P795-MQF2-36MF Backstage has a sensitive information disclosure in Kubernetes resource queries
Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...
GHSA-GP6M-X9VW-5C5X Backstage has improper authorization in GitLab organizational user ingestion
Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticate...
EUVD-2026-94000
Backstage has improper authorization in GitLab organizational user ingestion...
EUVD-2026-94003
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions...
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...
EUVD-2026-94005
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend...
GHSA-H53X-HJX6-25GR Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Impact Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources...