Vulnerabilities

TI-2026-80536 CVE-2026-115923 · GHSA-w658-mh9p-ww8f

Backstage catalog rules bypassed with encoded URL path segments

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00317 Published 2026-10-26 Fixed in 3.9.2, 4.0.2 CWE-22

TI-2026-80367 CVE-2026-111590 · GHSA-h7v4-fjg7-95fc

Server-side request forgery in Harbor webhook delivery

LOW 22

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges.

CVSS — EPSS 0.00213 Published 2026-10-26 Fixed in 2.15.3, 2.14.5 +1

TI-2026-74954 CVE-2026-111170

Path traversal in kedro-datasets lets attackers write files

LOW 31

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-15 No fix listed CWE-22

TI-2026-74982 CVE-2026-47218

Forged Wasmtime precompiled OCI layer escapes runwasi WASI sandbox

MEDIUM 48

runwasi facilitates running Wasm and WASI workloads managed by containerd.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00394 Published 2026-10-15 Fixed in 0.6.1 CWE-502

TI-2026-73584 CVE-2026-104252 · GHSA-v75v-6fpf-gvw8

Reflected cross-site scripting in Vitess vttablet /twopcz endpoint

MEDIUM 51

Vitess is a database clustering system for horizontal scaling of MySQL.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01174 Published 2026-10-13 Fixed in 23.0.5, 24.0.2 +2 CWE-79

TI-2026-71272 CVE-2026-106495 · GHSA-3xr5-8w6c-p5gw

Improper access control in Backstage backend action invocation

LOW 20

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-10-12 Fixed in 1.54.6, 0.17.8 CWE-284

TI-2026-71248 CVE-2026-95838 · GHSA-rp3h-jf77-q9p4

Repeated opaque whiteouts exhaust CPU in containerd layer unpack

LOW 21

containerd is an open-source container runtime.

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00223 Published 2026-10-12 Fixed in 1.7.35, 2.0.12 +2 CWE-400

TI-2026-71247 CVE-2026-95837 · GHSA-p7v4-vr35-mj6f

CRI checkpoint restore in containerd bypasses security context

LOW 35

containerd is an open-source container runtime.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00106 Published 2026-10-12 Fixed in 2.2.7, 2.3.4 CWE-269

TI-2026-69370 CVE-2026-107446 · GHSA-x6rr-cr6c-gvp3

Integer overflow in containerd overlaybd index loading

LOW 30

containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenari…

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00407 Published 2026-10-08 No fix listed CWE-190

TI-2026-69245 CVE-2026-106557 · GHSA-f7v3-xhm6-w245

Input validation flaw in Backstage TechDocs Markdown extension config

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00375 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-22

TI-2026-69170 CVE-2026-106563 · GHSA-r9ph-3637-55px

Improper entity validation exposes Kubernetes data in Backstage

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00225 Published 2026-10-07 Partial fix · 1.54.1, 0.21.8 CWE-20

TI-2026-69169 CVE-2026-106562 · GHSA-9325-vq29-gp3v

Incorrect authorization in Backstage search permission filtering

LOW 19

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-07 Partial fix · 1.54.1, 2.1.6 +1 CWE-754

TI-2026-69168 CVE-2026-106561 · GHSA-p795-mqf2-36mf

Sensitive data exposure in Backstage Kubernetes resource queries

LOW 22

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00197 Published 2026-10-07 Partial fix · 1.54.2, 0.21.9 CWE-200

TI-2026-69167 CVE-2026-106560 · GHSA-2cmg-v53w-8xfp

Path traversal in Backstage Scaffolder Confluence-to-Markdown module

LOW 31

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

TI-2026-69166 CVE-2026-106559 · GHSA-75qf-886x-5xf2

Input validation flaw in Backstage Confluence to Markdown scaffolder

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00332 Published 2026-10-07 Fixed in 1.54.6, 0.3.25 CWE-22

TI-2026-69165 CVE-2026-106558 · GHSA-qmw3-745m-w99g

Backstage TechDocs config flaw allows code execution

MEDIUM 40

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00469 Published 2026-10-07 Partial fix · 1.50.7, 1.54.9 +5 CWE-502

TI-2026-69164 CVE-2026-106556

Configuration bypass in Backstage TechDocs mkdocs.yml sanitization

LOW 33

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-184

TI-2026-69157 CVE-2026-106510 · GHSA-4488-j8vj-vqqv

Remote code execution in Backstage TechDocs via crafted mkdocs.yml

LOW 34

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00479 Published 2026-10-07 Partial fix · 1.50.5, 1.54.6 +2 CWE-183

TI-2026-69083 CVE-2026-106509 · GHSA-8w7q-29mw-gf5c

Code injection via MkDocs theme configuration in Backstage TechDocs

LOW 39

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00516 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-1336

TI-2026-69082 CVE-2026-106508 · GHSA-cm77-ch27-6w6v

File exposure through local TechDocs publisher in Backstage

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-22

TI-2026-69081 CVE-2026-106507

Arbitrary file read in Backstage TechDocs via mkdocs snippets

LOW 29

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-06 Fixed in 1.54.6, 1.15.4 CWE-59

TI-2026-69080 CVE-2026-106506 · GHSA-vwp5-f99x-x3rq

Improper input validation in Backstage scaffolder task list ordering

LOW 23

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-202

TI-2026-69079 CVE-2026-106505 · GHSA-p75x-jh7p-ppcx

Bypass of MkDocs config sanitizer in Backstage TechDocs backend

LOW 37

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-06 Partial fix · 1.50.5, 1.54.6 +2 CWE-426

TI-2026-69078 CVE-2026-106504 · GHSA-4xvq-3m68-h444

Sensitive information exposure in Backstage scaffolder task logs

LOW 28

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-06 Partial fix · 1.54.6, 4.1.0 CWE-532

TI-2026-69077 CVE-2026-106503 · GHSA-hmp2-4m7g-22cv

Authorization bypass in Backstage Scaffolder action inputs

LOW 38

Backstage is an open framework for building developer portals.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00492 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-178

Vulnerabilities

Filters