CVE-2026-106487

The @backstage/plugin-kubernetes-backend package in the Backstage framework (prior to version 0.21.10 ) is vulnerable to an Unintended Proxy or Intermediary ('Confused Deputy') flaw. The root cause is that the CatalogClusterLocator silently accepts cluster entities annotated with a serviceAccount...

CVE-2026-106487

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog...

Haas Automation Controller Access Control Vulnerability

Haas Automation Controller is an industrial control system from Haas Automation, USA. An access control error vulnerability exists in Haas Automation Controller version 100.20.000.1110 that stems from unsupported authentication...