backstage

Records663All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical58CVSS 9.0–10.0

CVSS high242CVSS 7.0–8.9

Exploited now

backstage records in CISA KEV

TI-2026-33119 TanStack Unspecified Vulnerability CRITICAL 100KEV 2026-05-27 TI-2018-10499 Linux Kernel Integer Overflow Vulnerability CRITICAL 93KEV 2026-01-26

Components

Products in the NVD configurations · select one to filter the records

Yocto 114 records MEDIUM Backstage 53 records MEDIUM Nats-server 36 records HIGH Pytorch 31 records HIGH Everest 29 records HIGH Harbor 24 records MEDIUM Containerd 22 records HIGH Magma 22 records MEDIUM

Records

8 records in Tekton Pipelines · all components

TI-2026-29590 CVE-2026-40938 · GHSA-94jr-7pqp-xhcq

Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

HIGH 72

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00788 Published 2026-04-21 Partial fix · 1.0.2, 1.3.4 +3 CWE-88

TI-2026-29578 CVE-2026-40924 · GHSA-m2cx-gpqf-qf74

Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

MEDIUM 62

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00318 Published 2026-04-21 Partial fix · 1.0.2, 1.3.4 +3 CWE-400

TI-2023-18894 CVE-2023-37264 · GHSA-w2h3-vvvq-3m53

Pipelines do not validate child UIDs

MEDIUM 53

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00379 Published 2023-07-07 No fix listed CWE-345

TI-2026-25632 CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

MEDIUM 42

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00583 Published 2026-03-23 Partial fix · 1.0.1, 1.3.3 +3 CWE-22

TI-2026-28976 CVE-2026-40161 · GHSA-wjxp-xrpv-xpff

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

LOW 33

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0026 Published 2026-04-21 Partial fix · 1.0.2, 1.3.4 +3 CWE-201

TI-2026-25468 CVE-2026-33022 · GHSA-cv4x-93xx-wgfj

Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun

LOW 29

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00383 Published 2026-03-20 Partial fix · 1.0.1, 1.3.3 +3 CWE-129

TI-2026-20651 CVE-2026-25542 · GHSA-rmx9-2pp3-xhcr

Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching

LOW 28

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00264 Published 2026-04-21 Partial fix · 1.0.2, 1.3.4 +3 CWE-185

TI-2026-29577 CVE-2026-40923 · GHSA-rx35-6rhx-7858

Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check

LOW 24

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0022 Published 2026-04-21 Partial fix · 1.0.2, 1.3.4 +3 CWE-22

Open these records in search →