PT-2026-107299

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package may expose sensitive information within Scaffolder task failure events. An authenticated user can retrieve backend-managed credentials used during...

CVE-2026-106501: Exposure of Sensitive Information to an Unauthorized Actor

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-89289: Missing Authorization

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

PT-2026-107281

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains an issue regarding inconsistent catalog property permission evaluation. In environments where value-based catalog permission conditions are us...

PT-2026-106782

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-ecommerce versions prior to 3.90.0 @payloadcms/plugin-ecommerce versions prior to 4.0.0-canary.34 Description When using the Stripe payment adapter, a Stripe order confirmation can be processed multiple times under certain...

PT-2026-107263

Name of the Vulnerable Software and Affected Versions Backstage versions 0.3.0 through 0.6.14 Backstage versions 0.7.0 through 0.7.4 Description The @backstage/plugin-auth-node package fails to consistently honor explicit negative email verification during shared OAuth profile normalization. This...

CVE-2026-105848: Exposed Dangerous Method or Function

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

PT-2026-107305

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package allows potential file exposure when the local TechDocs publisher is used via the techdocs.publisher.type variable set to 'local'. In this configuration,...

PT-2026-107245

Name of the Vulnerable Software and Affected Versions Backstage versions 0.5.0 through 0.6.17 Description The @backstage/plugin-proxy-backend package contains inconsistent credential enforcement for overlapping proxy routes. This occurs when an operator configures overlapping proxy paths with...

CVE-2026-106457: Improper Authentication

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies ...

CVE-2026-106488: Improper Authentication

Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution with a provider that permits unverifi...

CVE-2026-106508: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106458: Incorrect Authorization

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the...

CVE-2026-106461: Incorrect Authorization

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

PT-2026-107296

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package may expose secret-derived values within Scaffolder task logs. This occurs in deployments where sensitive scaffolder.defaultEnvironment.secrets are...

CVE-2026-106491: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

Linux Distros Unpatched Vulnerability : CVE-2026-104036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but...

SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:23984-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23984-1 advisory. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. -...

CVE-2026-106455: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

PT-2026-107246

Name of the Vulnerable Software and Affected Versions @backstage/plugin-auth-backend-module-cloudflare-access-provider versions 0.1.0 through 0.4.9 Description Insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for a different Access applicati...