backstage

Records663All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical58CVSS 9.0–10.0

CVSS high242CVSS 7.0–8.9

Exploited now

backstage records in CISA KEV

TI-2026-33119 TanStack Unspecified Vulnerability CRITICAL 100KEV 2026-05-27 TI-2018-10499 Linux Kernel Integer Overflow Vulnerability CRITICAL 93KEV 2026-01-26

Components

Products in the NVD configurations · select one to filter the records

Yocto 114 records MEDIUM Backstage 53 records MEDIUM Nats-server 36 records HIGH Pytorch 31 records HIGH Everest 29 records HIGH Harbor 24 records MEDIUM Containerd 22 records HIGH Magma 22 records MEDIUM

Records

36 records in Nats-server · all components

TI-2026-22233 CVE-2026-27889 · GHSA-pq2q-rcw4-3hr6

NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead

HIGH 72

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00593 Published 2026-03-25 Fixed in 2.11.14, 2.12.5 CWE-190

TI-2022-11116 CVE-2022-28357 · GHSA-vpjc-4jcv-jc29

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended…

MEDIUM 51

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01158 Published 2023-09-19 Fixed in 2.7.4 CWE-22

TI-2020-16319 CVE-2020-26892 · GHSA-4w5x-x539-ppf5

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of…

MEDIUM 47

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02328 Published 2020-11-06 Fixed in 1.1.0 CWE-798

TI-2026-25637 CVE-2026-33216 · GHSA-v722-jcv5-w7mc

NATS has MQTT plaintext password disclosure

MEDIUM 43

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00372 Published 2026-03-25 Fixed in 2.11.15, 2.12.6 CWE-256

TI-2022-08320 CVE-2022-24450 · GHSA-g6w6-r76c-28j7

NATS nats-server before 2.7.2 has Incorrect Access Control.

MEDIUM 41

NATS nats-server before 2.7.2 has Incorrect Access Control.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2022-02-08 Partial fix · 2.7.2, 0.24.1 CWE-862

TI-2026-41950 CVE-2026-58250

NATS Server: Pre-auth server crash via double INFO in leafnode handshake

MEDIUM 40

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00742 Published 2026-07-08 Fixed in 2.11.17, 2.12.8 CWE-476

TI-2026-41920 CVE-2026-58210

NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory

MEDIUM 40

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00742 Published 2026-07-08 Fixed in 2.12.12, 2.14.3 CWE-400

TI-2026-25639 CVE-2026-33218 · GHSA-vprv-35vv-q339

NATS has pre-auth server panic via leafnode handling

MEDIUM 40

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00627 Published 2026-03-25 Fixed in 2.12.6, 2.11.15 CWE-20

TI-2026-23371 CVE-2026-29785 · GHSA-52jh-2xxh-pwh6

NATS Server panic via malicious compression on leafnode port

MEDIUM 40

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00684 Published 2026-03-25 Fixed in 2.11.14, 2.12.5 CWE-476

TI-2023-24771 CVE-2023-46129 · GHSA-mr45-rx8q-wcm9

xkeys Seal encryption used fixed key for all encryption

LOW 39

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00446 Published 2023-10-30 Partial fix · 2.10.4, 0.4.6 CWE-321

TI-2020-17280 CVE-2020-28466 · GHSA-m4jx-6526-vvhm

Denial of service (DoS) in github.com/nats-io/nats-server/server

LOW 39

This affects all versions of package github.com/nats-io/nats-server/server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03729 Published 2021-03-07 Fixed in 2.2.0 CWE-400

TI-2026-41953 CVE-2026-58253

NATS Server: Route API Auth Bypass

LOW 38

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00368 Published 2026-07-08 Fixed in 2.11.16, 2.12.6 CWE-287

TI-2020-16164 CVE-2020-26521 · GHSA-h2fg-54x9-5qhq

The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).

LOW 37

The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02157 Published 2020-11-06 Fixed in 1.1.0 CWE-476

TI-2021-02219 CVE-2021-3127 · GHSA-62mh-w5cv-p88c

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control…

LOW 36

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01448 Published 2021-03-16 Fixed in 2.0.1 CWE-755

TI-2019-09831 CVE-2019-13126 · GHSA-jp4j-47f9-2vc3

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the…

LOW 36

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01773 Published 2019-07-29 Fixed in 2.2.0 CWE-190

TI-2026-25665 CVE-2026-33247 · GHSA-x6g4-f6q3-fqvv

NATS credentials are exposed in monitoring port via command-line argv

LOW 35

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0043 Published 2026-03-25 Fixed in 2.11.15, 2.12.6 CWE-215

TI-2026-41918 CVE-2026-58208

NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled

LOW 34

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.006 Published 2026-07-08 Fixed in 2.14.3, 2.12.12 CWE-248

TI-2026-41917 CVE-2026-58207

NATS Server: Remote crash via integer overflow in Connz pagination

LOW 34

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0056 Published 2026-07-08 Partial fix · 2.12.12, 2.14.3 CWE-190

TI-2026-21964 CVE-2026-27571 · GHSA-qrvq-68c2-7grw

nats-server websockets are vulnerable to pre-auth memory DoS

LOW 34

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00542 Published 2026-02-24 Partial fix · 2.11.12, 2.12.3 CWE-409

TI-2022-09926 CVE-2022-26652 · GHSA-6h3m-36w8-hv68

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an…

LOW 33

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02342 Published 2022-03-10 Fixed in 2.7.4, 0.24.3 CWE-22

TI-2026-41922 CVE-2026-58213

NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

LOW 32

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00441 Published 2026-07-08 Fixed in 2.12.9, 2.14.1 CWE-74

TI-2026-25638 CVE-2026-33217 · GHSA-jxxm-27vp-c3m5

NATS allows MQTT clients to bypass ACL checks

LOW 31

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00264 Published 2026-03-25 Fixed in 2.11.15, 2.12.6 CWE-863

TI-2023-25433 CVE-2023-47090 · GHSA-fr2g-9hjm-wr23

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.

LOW 30

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00825 Published 2023-10-30 Fixed in 2.9.23, 2.10.2 CWE-863

TI-2026-41952 CVE-2026-58252

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

LOW 29

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00464 Published 2026-07-08 Fixed in 2.11.16, 2.12.7 CWE-285

TI-2026-41951 CVE-2026-58251

NATS Server: Queue Subscribe Authz Bypass

LOW 29

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00463 Published 2026-07-08 Fixed in 2.11.16, 2.12.7 CWE-285

Open these records in search →