backstage

Records663All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical58CVSS 9.0–10.0

CVSS high242CVSS 7.0–8.9

Exploited now

backstage records in CISA KEV

TI-2026-33119 TanStack Unspecified Vulnerability CRITICAL 100KEV 2026-05-27 TI-2018-10499 Linux Kernel Integer Overflow Vulnerability CRITICAL 93KEV 2026-01-26

Components

Products in the NVD configurations · select one to filter the records

Yocto 114 records MEDIUM Backstage 53 records MEDIUM Nats-server 36 records HIGH Pytorch 31 records HIGH Everest 29 records HIGH Harbor 24 records MEDIUM Containerd 22 records HIGH Magma 22 records MEDIUM

Records

11 records in Backstage/plugin-scaffolder-backend · all components

TI-2026-69075 CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p

Sensitive information exposure in Backstage Scaffolder

MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00484 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-200

TI-2026-69074 CVE-2026-106500 · GHSA-xvgh-hmx8-9xxf

Race condition in Backstage scaffolder backend task handling

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-362

TI-2026-69077 CVE-2026-106503 · GHSA-hmp2-4m7g-22cv

Authorization bypass in Backstage Scaffolder action inputs

LOW 38

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00492 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-178

TI-2026-24766 CVE-2026-32237 · GHSA-8wq8-6859-qx77

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00284 Published 2026-03-12 Partial fix · 3.1.5 CWE-200

TI-2026-23301 CVE-2026-29184 · GHSA-8qp7-fhr9-fw53

@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00305 Published 2026-03-07 Partial fix · 3.1.4 CWE-532

TI-2026-69078 CVE-2026-106504 · GHSA-4xvq-3m68-h444

Sensitive information exposure in Backstage scaffolder task logs

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69058 CVE-2026-106462 · GHSA-29gx-h2m3-xw44

Backstage scaffolder may fall back to broader integration credentials

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00172 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 +4 CWE-441

TI-2026-69076 CVE-2026-106502 · GHSA-95p4-vv4g-jxxm

Backstage Scaffolder exposes sensitive data in task failure events

LOW 24

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00291 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69080 CVE-2026-106506 · GHSA-vwp5-f99x-x3rq

Improper input validation in Backstage scaffolder task list ordering

LOW 23

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-202

TI-2026-69073 CVE-2026-106499 · GHSA-mfvq-x7vr-rgqg

Secret-derived values exposed in Backstage scaffolder task logs

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0027 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69057 CVE-2026-106461 · GHSA-7hfw-grcm-cqm6

Incorrect authorization in Backstage scaffolder task listing

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-863

Open these records in search →