Security advisories

critical2026-10-07

CVE-2026-106501-Backstage: Sensitive information exposure in Scaffolder

View chart →

backstage/backstage · GHSA-g2v8-7jhw-pp8p

medium2026-10-07

CVE-2026-106499-Backstage: Secret-derived values may be exposed in scaffolder task logs

View chart →

backstage/backstage · GHSA-mfvq-x7vr-rgqg

high2026-10-07

CVE-2026-106503-Backstage: Scaffolder action input authorization bypass

View chart →

backstage/backstage · GHSA-hmp2-4m7g-22cv

high2026-10-07

CVE-2026-106500-Backstage: Improper task state validation in Scaffolder backend

View chart →

backstage/backstage · GHSA-xvgh-hmx8-9xxf

medium2026-10-07

CVE-2026-106461-Backstage: Incorrect authorization in scaffolder task listing

View chart →

backstage/backstage · GHSA-7hfw-grcm-cqm6

medium2026-10-07

CVE-2026-106502-Backstage may expose sensitive information in Scaffolder task failure events

View chart →

backstage/backstage · GHSA-95p4-vv4g-jxxm

medium2026-10-07

CVE-2026-106504-Backstage has sensitive information exposure in scaffolder task logs

View chart →

backstage/backstage · GHSA-4xvq-3m68-h444

medium2026-10-07

CVE-2026-106506-Backstage has improper input validation in scaffolder task list ordering

View chart →

backstage/backstage · GHSA-vwp5-f99x-x3rq

high2026-10-07

CVE-2026-106505-Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

View chart →

backstage/backstage · GHSA-p75x-jh7p-ppcx

medium2026-10-07

CVE-2026-106508-Backstage has potential file exposure through local TechDocs publisher

View chart →

backstage/backstage · GHSA-cm77-ch27-6w6v

high2026-10-07

CVE-2026-106509-Backstage: Improper validation of MkDocs theme configuration in TechDocs

View chart →

backstage/backstage · GHSA-8w7q-29mw-gf5c

high2026-10-07

CVE-2026-106557-Backstage has improper input validation in TechDocs Markdown extension configuration

View chart →

backstage/backstage · GHSA-f7v3-xhm6-w245

high2026-10-07

CVE-2026-106100-Payload: Field-level write access bypass in Payload on MongoDB

View chart →

payloadcms/payload · GHSA-4ww4-68q3-h7g5

medium2026-10-07

CVE-2026-106123-RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

View chart →

rabbitmq/rabbitmq-java-client · GHSA-h6w7-qmcm-q6xr

medium2026-10-07

CVE-2026-106120-LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

View chart →

harttle/liquidjs · GHSA-fwxr-j5w2-587m

high2026-10-07

CVE-2026-106118-ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

View chart →

sixlabors/imagesharp · GHSA-v76p-62qx-wwq2

high2026-10-07

CVE-2026-106117-ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

View chart →

sixlabors/imagesharp · GHSA-jj3q-cwqj-842r

medium2026-10-07

CVE-2026-106454-Twisted: IMAP wildcardToRegexp() ReDoS

View chart →

twisted/twisted · GHSA-8pqf-f4m5-798g

high2026-10-07

CVE-2026-105741-Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

View chart →

langflow-ai/langflow · GHSA-4f6c-2vvp-gw82

medium2026-10-07

CVE-2026-105681-Ghost: Authorization Bypass in Comments Feature

View chart →

tryghost/ghost · GHSA-6q6j-f24j-p477