backstage

Records663All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical58CVSS 9.0–10.0

CVSS high242CVSS 7.0–8.9

Exploited now

backstage records in CISA KEV

TI-2026-33119 TanStack Unspecified Vulnerability CRITICAL 100KEV 2026-05-27 TI-2018-10499 Linux Kernel Integer Overflow Vulnerability CRITICAL 93KEV 2026-01-26

Components

Products in the NVD configurations · select one to filter the records

Yocto 114 records MEDIUM Backstage 53 records MEDIUM Nats-server 36 records HIGH Pytorch 31 records HIGH Everest 29 records HIGH Harbor 24 records MEDIUM Containerd 22 records HIGH Magma 22 records MEDIUM

Records

53 records in Backstage · all components

TI-2023-17988 CVE-2023-35926 · GHSA-wg6p-jmpc-xjmr

Insecure sandbox in Backstage Scaffolder plugin

MEDIUM 47

Backstage is an open platform for building developer portals.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01888 Published 2023-06-22 Fixed in 1.15.0 CWE-94

TI-2026-69075 CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p

Sensitive information exposure in Backstage Scaffolder

MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00484 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-200

TI-2026-69061 CVE-2026-106486 · GHSA-g8rx-f7m5-7794

Path traversal in Backstage Bitbucket pull-request scaffolder actions

MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00367 Published 2026-10-06 Fixed in 1.54.6, 0.3.10 +1 CWE-22

TI-2026-60083 CVE-2026-88064

Backstage: Improper input validation in TechDocs MkDocs configuration

MEDIUM 42

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0118 Published 2026-09-16 Fixed in 1.14.6, 1.15.4 CWE-1336

TI-2026-69165 CVE-2026-106558 · GHSA-qmw3-745m-w99g

Backstage TechDocs config flaw allows code execution

MEDIUM 40

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00469 Published 2026-10-07 Partial fix · 1.50.7, 1.54.9 +5 CWE-502

TI-2026-69083 CVE-2026-106509 · GHSA-8w7q-29mw-gf5c

Code injection via MkDocs theme configuration in Backstage TechDocs

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-1336

TI-2026-69074 CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf

Race condition in Backstage scaffolder backend task handling

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-362

TI-2026-20315 CVE-2026-25153 · GHSA-6jr7-99pf-8vgf

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

LOW 39

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00606 Published 2026-01-30 Partial fix · 1.13.11, 1.14.1 CWE-94

TI-2021-19590 CVE-2021-43783 · GHSA-mg3m-f475-28hv

Path Traversal in @backstage/plugin-scaffolder-backend

LOW 39

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.01246 Published 2021-11-29 Fixed in 0.15.14 CWE-22

TI-2026-69077 CVE-2026-106503 · GHSA-hmp2-4m7g-22cv

Authorization bypass in Backstage Scaffolder action inputs

LOW 38

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00492 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-178

TI-2026-69079 CVE-2026-106505 · GHSA-p75x-jh7p-ppcx

Bypass of MkDocs config sanitizer in Backstage TechDocs backend

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-426

TI-2026-69063 CVE-2026-106488 · GHSA-826h-28h9-65hg

Backstage: Improper authentication in the OIDC provider

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0028 Published 2026-10-06 Partial fix · 1.54.6, 0.4.20 CWE-287

TI-2026-69053 CVE-2026-106457 · GHSA-q333-f498-w2x7

Improper authentication in Backstage Cloudflare Access auth provider

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00354 Published 2026-10-06 Partial fix · 1.55.0, 0.5.0 CWE-287

TI-2026-69055 CVE-2026-106459 · GHSA-g734-fhp4-7mfp

Improper input validation in Backstage Sentry scaffolder actions

LOW 36

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00212 Published 2026-10-06 Fixed in 1.54.8, 0.3.8 CWE-200

TI-2026-69157 CVE-2026-106510 · GHSA-4488-j8vj-vqqv

Remote code execution in Backstage TechDocs via crafted mkdocs.yml

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00479 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-183

TI-2026-69051 CVE-2026-106455 · GHSA-q38j-6vcm-2f5m

Server-side request forgery in Backstage TechDocs MkDocs plugin

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0042 Published 2026-10-06 Partial fix · 1.50.6, 1.54.8 +2 CWE-918

TI-2026-69164 CVE-2026-106556

Configuration bypass in Backstage TechDocs mkdocs.yml sanitization

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-184

TI-2026-69072 CVE-2026-106498 · GHSA-qgvj-qcf8-xq73

Improper URL validation in Backstage catalog entity placeholders

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00307 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +8 CWE-863

TI-2026-69067 CVE-2026-106492 · GHSA-cq7v-rfgc-5c7v

Backstage: Improper preservation of access restrictions during service credential delegation

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00208 Published 2026-10-06 Partial fix · 1.49.6, 1.54.6 +2 CWE-269

TI-2021-17990 CVE-2021-41151 · GHSA-pvv8-8fx9-h673

Path Traversal in @backstage/plugin-scaffolder-backend

LOW 33

Backstage is an open platform for building developer portals.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.01315 Published 2021-10-18 Fixed in 0.15.9 CWE-22

TI-2026-69056 CVE-2026-106460 · GHSA-xm5q-p7w3-x6cp

Backstage auth-node ignores unverified OAuth profile emails

LOW 32

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00396 Published 2026-10-06 Partial fix · 1.49.7, 1.54.7 +2 CWE-287

TI-2026-69167 CVE-2026-106560 · GHSA-2cmg-v53w-8xfp

Path traversal in Backstage Scaffolder Confluence-to-Markdown module

LOW 31

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

TI-2021-12330 CVE-2021-32662 · GHSA-pgf8-28gg-vpr6

TechDocs mkdocs.yml path traversal

LOW 31

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0128 Published 2021-06-03 Fixed in 0.6.3 CWE-22

TI-2024-30781 CVE-2024-45816 · GHSA-39v3-f278-vj3g

Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

LOW 30

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00728 Published 2024-09-17 Fixed in 1.10.13 CWE-23

TI-2026-69166 CVE-2026-106559 · GHSA-75qf-886x-5xf2

Input validation flaw in Backstage Confluence to Markdown scaffolder

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00332 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

Open these records in search →