Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107299msgpack5: Reserved byte can cause unbounded stream bufferingnpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107298msgpack5: Deeply nested input can exhaust the decoder stacknpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107297msgpack5: Quadratic parsing in the streaming decodernpm · msgpack5 · fixed in 6.1.0
- CVE-2026-107296msgpack5: Decoding negative int64 values mutates the input buffernpm · msgpack5 · fixed in 6.1.0
- CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configurationnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpointnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.8
- CVE-2026-106562Backstage: Incorrect authorization in search engine permission filteringnpm · @backstage/plugin-search-backend, @backstage/plugin-search-backend-module-elasticsearch · fixed in 2.1.6, 1.8.7
- CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queriesnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.9
- CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend modulenpm · @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · fixed in 0.3.25
- CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder modulenpm · @backstage/plugin-scaffolder-backend-module-confluence-to-markdown · fixed in 0.3.25
- CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configurationnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocsnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106508Backstage: Potential file exposure through local TechDocs publishernpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106506Backstage: Improper input validation in scaffolder task list orderingnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backendnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106504Backstage: Sensitive information exposure in scaffolder task logsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106503Backstage: Scaffolder action input authorization bypassnpm · @backstage/plugin-scaffolder-backend · fixed in 3.3.1, 3.4.1, 4.0.3 and more
- CVE-2026-106502Backstage: Sensitive information may be exposed in Scaffolder task failure eventsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106501Backstage: Sensitive information exposure in Scaffoldernpm · @backstage/plugin-scaffolder-backend · fixed in 3.3.1, 3.4.1, 4.0.3 and more
- CVE-2026-106500Backstage: Improper task state validation in Scaffolder backendnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106499Backstage: Secret-derived values may be exposed in scaffolder task logsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106498Backstage: Improper URL validation in catalog entity placeholder resolutionnpm · @backstage/plugin-catalog-backend · fixed in 3.9.1
- CVE-2026-106496Backstage: Inconsistent enforcement of allowed location types during catalog processingnpm · @backstage/plugin-catalog-backend · fixed in 3.9.1
- CVE-2026-106494Backstage: Improper input validation in cloud storage URL readersnpm · @backstage/backend-defaults · fixed in 0.17.8
- CVE-2026-106493Backstage: Cloud storage catalog locations may cross configured storage boundariesnpm · @backstage/backend-defaults, @backstage/plugin-catalog-backend-module-aws +1 · fixed in 0.17.8, 0.4.27, 0.3.21
- CVE-2026-106492Backstage: Improper preservation of access restrictions during service credential delegationnpm · @backstage/backend-defaults · fixed in 0.17.8
- CVE-2026-106491Backstage: Improper input validation in proxy-backendnpm · @backstage/plugin-proxy-backend · fixed in 0.6.17
- CVE-2026-106490Backstage: Improper input validation in TechDocs static content requestsnpm · @backstage/plugin-techdocs-backend · fixed in 2.2.4
- CVE-2026-106489Backstage: Improper authorization enforcement for TechDocs static contentnpm · @backstage/plugin-techdocs-backend · fixed in 2.2.4