AZL-107300 CVE-2026-107161 affecting package cyrus-sasl-bootstrap 2.1.28-8

A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting escaping special characters mak...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Impact An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Patches Patched in @backstage/plugin-techdocs-node, version 1.15.4. Workarounds If you cannot upgrade...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825498...

Deserialization of Untrusted Data

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malforme...

GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

@backstage/plugin-search-backend-module-techdocs (0.4.19-next.0), @backstage/plugin-techdocs-backend (2.3.1-next.0) +1 more potentially affected by CVE-2026-106558 via @backstage/plugin-techdocs-node (2.0.1-next.0)

@backstage/plugin-techdocs-node NPM version 2.0.1-next.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-techdocs-node and may be impacted: - @backstage/plugin-search-backend-module-techdocs 0.4.19-next.0 -...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106558 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106558 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-20825497...

Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

External Control of File Name or Path

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in...

Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...

Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

Incorrect Authorization

Overview @backstage/plugin-search-backend-module-elasticsearch is an A module for the search backend that implements search using ElasticSearch Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization...

Incorrect Authorization

Overview @backstage/plugin-search-backend is a The Backstage backend plugin that provides your backstage app with search Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizedSearchEngine when all document types are denied by authorization policy. An authenticat...

Backstage has incorrect authorization in search engine permission filtering

Impact An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend. Patches - Upgrade...

Missing Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Missing Authorization via the Kubernetes objects endpoint in KubernetesRouter, where the entity field supplied in the request body ...

Incorrect Authorization

Overview @backstage/plugin-kubernetes-backend is an A Backstage backend plugin that integrates towards Kubernetes Affected versions of this package are vulnerable to Incorrect Authorization via the sanitizeKubernetesResponse method in KubernetesFetcher.ts, where Kubernetes Secret values are not...

GHSA-P795-MQF2-36MF Backstage has a sensitive information disclosure in Kubernetes resource queries

Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...