Vulnerabilities in backstage
69 resultsCVE-2023-25571MEDIUMBackstage has XSS Vulnerability in Software CatalogEPSS 0.5%CVE-2026-25152MEDIUM@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local GeneratorEPSS 0.4%CVE-2026-106455HIGHBackstage: Improper validation of MkDocs plugin configuration in TechDocsEPSS 0.4%CVE-2024-47762MEDIUMUnexpected visibility of environment variable configurations in @backstage/plugin-app-backendEPSS 0.4%CVE-2026-106460MEDIUMBackstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationEPSS 0.4%CVE-2026-29185LOW@backstage/integration: Potential reading of SCM URLs using built in tokenEPSS 0.4%CVE-2024-53983MEDIUMServer-side request forgery in Backstage Scaffolder pluginEPSS 0.4%CVE-2026-106508MEDIUMBackstage: Potential file exposure through local TechDocs publisherEPSS 0.4%CVE-2026-106507MEDIUMBackstage: TechDocs arbitrary file read via mkdocs snippetsEPSS 0.4%CVE-2026-106557HIGHBackstage: Improper input validation in TechDocs Markdown extension configurationEPSS 0.4%CVE-2026-106490MEDIUMBackstage: Improper input validation in TechDocs static content requestsEPSS 0.4%CVE-2026-106486HIGHBackstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionsEPSS 0.4%CVE-2026-106457MEDIUMBackstage: Insufficient audience validation in the Cloudflare Access auth providerEPSS 0.4%CVE-2026-106500HIGHBackstage: Improper task state validation in Scaffolder backendEPSS 0.3%CVE-2026-106559MEDIUMBackstage: Improper input validation in Confluence to Markdown scaffolder moduleEPSS 0.3%CVE-2026-115923MEDIUMBackstage catalog rules can be bypassed for URL locations using encoded path segmentsEPSS 0.3%CVE-2026-106560HIGHBackstage: Improper repository path validation in a Scaffolder backend moduleEPSS 0.3%CVE-2026-106505HIGHBackstage: Bypass of MkDocs configuration sanitizer in TechDocs backendEPSS 0.3%CVE-2026-106498HIGHBackstage: Improper URL validation in catalog entity placeholder resolutionEPSS 0.3%CVE-2026-106494MEDIUMBackstage: Improper input validation in cloud storage URL readersEPSS 0.3%