@backstage backstage

• CVE-2026-115923 Medium 6.5 Backstage catalog rules can be bypassed for URL locations using encoded path segments 0.3%
• CVE-2026-106495 Medium 4.3 Backstage: Improper access control in backend action invocation 0.2%
• CVE-2026-106557 High 7.7 Backstage: Improper input validation in TechDocs Markdown extension configuration 0.4%
• CVE-2026-106563 Medium 5.3 Backstage: Improper entity validation in deprecated Kubernetes services endpoint 0.2%
• CVE-2026-106562 Medium 4.3 Backstage: Incorrect authorization in search engine permission filtering 0.2%
• CVE-2026-106561 Medium 5.0 Backstage: Sensitive information disclosure in Kubernetes resource queries 0.2%
• CVE-2026-106560 High 7.1 Backstage: Improper repository path validation in a Scaffolder backend module 0.3%
• CVE-2026-106559 Medium 6.3 Backstage: Improper input validation in Confluence to Markdown scaffolder module 0.3%
• CVE-2026-106558 High 8.8 Backstage: Improper validation of TechDocs MkDocs configuration 0.5%
• CVE-2026-106556 High 7.7 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization 0.3%
• CVE-2026-106510 High 7.7 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml 0.5%
• CVE-2026-106509 High 7.7 Backstage: Improper validation of MkDocs theme configuration in TechDocs 0.5%
• CVE-2026-106508 Medium 5.3 Backstage: Potential file exposure through local TechDocs publisher 0.4%
• CVE-2026-106507 Medium 5.3 Backstage: TechDocs arbitrary file read via mkdocs snippets 0.4%
• CVE-2026-106506 Medium 5.3 Backstage: Improper input validation in scaffolder task list ordering 0.2%
• CVE-2026-106505 High 7.7 Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend 0.3%
• CVE-2026-106504 Medium 6.5 Backstage: Sensitive information exposure in scaffolder task logs 0.3%
• CVE-2026-106503 High 8.1 Backstage: Scaffolder action input authorization bypass 0.5%
• CVE-2026-106502 Medium 5.3 Backstage: Sensitive information may be exposed in Scaffolder task failure events 0.3%
• CVE-2026-106501 Critical 9.6 Backstage: Sensitive information exposure in Scaffolder 0.5%
• CVE-2026-106500 High 8.5 Backstage: Improper task state validation in Scaffolder backend 0.3%
• CVE-2026-106499 Medium 4.9 Backstage: Secret-derived values may be exposed in scaffolder task logs 0.3%
• CVE-2026-106498 High 7.7 Backstage: Improper URL validation in catalog entity placeholder resolution 0.3%
• CVE-2026-106497 Medium 4.3 Backstage: Inconsistent catalog property permission evaluation 0.2%
• CVE-2026-106496 Low 3.1 Backstage: Inconsistent enforcement of allowed location types during catalog processing 0.2%
• CVE-2026-106494 Medium 4.4 Backstage: Improper input validation in cloud storage URL readers 0.3%
• CVE-2026-106493 Low 3.0 Backstage: Cloud storage catalog locations may cross configured storage boundaries 0.3%
• CVE-2026-106492 High 7.6 Backstage: Improper preservation of access restrictions during service credential delegation 0.2%
• CVE-2026-106491 Medium 6.4 Backstage: Improper input validation in proxy-backend 0.3%
• CVE-2026-106490 Medium 6.5 Backstage: Improper input validation in TechDocs static content requests 0.4%
• CVE-2026-106489 Medium 6.5 Backstage: Improper authorization enforcement for TechDocs static content 0.3%
• CVE-2026-106488 High 8.1 Backstage: Improper authentication in the OIDC provider 0.3%
• CVE-2026-106487 Low 3.5 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend 0.3%
• CVE-2026-106486 High 8.5 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions 0.4%
• CVE-2026-106463 Medium 5.4 Backstage: Improper authorization in GitLab organizational user ingestion 0.2%
• CVE-2026-106462 Medium 6.4 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback 0.2%
• CVE-2026-106461 Medium 4.3 Backstage: Incorrect authorization in scaffolder task listing 0.2%
• CVE-2026-106460 Medium 6.8 Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization 0.4%
• CVE-2026-106459 High 8.5 Backstage: Improper input validation in Sentry scaffolder actions 0.2%
• CVE-2026-106458 Medium 6.5 Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates 0.3%
• CVE-2026-106457 Medium 6.8 Backstage: Insufficient audience validation in the Cloudflare Access auth provider 0.4%
• CVE-2026-106456 Medium 4.8 Backstage: Inconsistent credential enforcement for overlapping proxy routes 0.2%
• CVE-2026-106455 High 7.7 Backstage: Improper validation of MkDocs plugin configuration in TechDocs 0.4%
• CVE-2026-88064 High 8.8 Backstage: Improper input validation in TechDocs MkDocs configuration 1.2%
• CVE-2026-73563 Medium 4.7 Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend` 0.2%
• CVE-2026-29186 High 7.7 @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution 0.9%
• CVE-2026-29184 Low 2.0 @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass 0.3%
• CVE-2026-29185 Low 2.7 @backstage/integration: Potential reading of SCM URLs using built in token 0.4%
• CVE-2026-25152 Medium 5.3 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator 0.4%
• CVE-2026-25153 High 7.7 @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks 0.6%