Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43976wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)PyPI · wger
- CVE-2026-105192LMCache Unauthenticated RCE in multiprocess mode via pickle deserializationPyPI · lmcache · fixed in 0.5.6
- CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocsnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106508Backstage: Potential file exposure through local TechDocs publishernpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106506Backstage: Improper input validation in scaffolder task list orderingnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backendnpm · @backstage/plugin-techdocs-node · fixed in 1.15.4
- CVE-2026-106504Backstage: Sensitive information exposure in scaffolder task logsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106503Backstage: Scaffolder action input authorization bypassnpm · @backstage/plugin-scaffolder-backend · fixed in 3.3.1, 3.4.1, 4.0.3 and more
- CVE-2026-106502Backstage: Sensitive information may be exposed in Scaffolder task failure eventsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106501Backstage: Sensitive information exposure in Scaffoldernpm · @backstage/plugin-scaffolder-backend · fixed in 3.3.1, 3.4.1, 4.0.3 and more
- CVE-2026-106500Backstage: Improper task state validation in Scaffolder backendnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106499Backstage: Secret-derived values may be exposed in scaffolder task logsnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106498Backstage: Improper URL validation in catalog entity placeholder resolutionnpm · @backstage/plugin-catalog-backend · fixed in 3.9.1
- CVE-2026-106496Backstage: Inconsistent enforcement of allowed location types during catalog processingnpm · @backstage/plugin-catalog-backend · fixed in 3.9.1
- CVE-2026-106494Backstage: Improper input validation in cloud storage URL readersnpm · @backstage/backend-defaults · fixed in 0.17.8
- CVE-2026-106493Backstage: Cloud storage catalog locations may cross configured storage boundariesnpm · @backstage/backend-defaults, @backstage/plugin-catalog-backend-module-aws +1 · fixed in 0.17.8, 0.4.27, 0.3.21
- CVE-2026-106492Backstage: Improper preservation of access restrictions during service credential delegationnpm · @backstage/backend-defaults · fixed in 0.17.8
- CVE-2026-106491Backstage: Improper input validation in proxy-backendnpm · @backstage/plugin-proxy-backend · fixed in 0.6.17
- CVE-2026-106490Backstage: Improper input validation in TechDocs static content requestsnpm · @backstage/plugin-techdocs-backend · fixed in 2.2.4
- CVE-2026-106489Backstage: Improper authorization enforcement for TechDocs static contentnpm · @backstage/plugin-techdocs-backend · fixed in 2.2.4
- CVE-2026-106488Backstage: Improper authentication in the OIDC providernpm · @backstage/plugin-auth-backend-module-oidc-provider · fixed in 0.4.20
- CVE-2026-106487Backstage: Unsupported catalog cluster authentication mode in kubernetes backendnpm · @backstage/plugin-kubernetes-backend · fixed in 0.21.10
- CVE-2026-106486Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionsnpm · @backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server · fixed in 0.3.10, 0.2.25
- CVE-2026-106463Backstage: Improper authorization in GitLab organizational user ingestionnpm · @backstage/plugin-catalog-backend-module-gitlab · fixed in 0.8.7
- CVE-2026-106462Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallbacknpm · @backstage/plugin-scaffolder-backend, @backstage/plugin-scaffolder-backend-module-azure +4 · fixed in 4.1.0, 0.2.25, 0.3.10 and more
- CVE-2026-106461Backstage: Incorrect authorization in scaffolder task listingnpm · @backstage/plugin-scaffolder-backend · fixed in 4.1.0
- CVE-2026-106460Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationnpm · @backstage/plugin-auth-node · fixed in 0.6.15, 0.7.5
- CVE-2026-106459Backstage: Improper input validation in Sentry scaffolder actionsnpm · @backstage/plugin-scaffolder-backend-module-sentry · fixed in 0.3.8
- CVE-2026-106458Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updatesnpm · @backstage/plugin-catalog-backend-module-bitbucket-server · fixed in 0.5.15
- CVE-2026-106457Backstage: Insufficient audience validation in the Cloudflare Access auth providernpm · @backstage/plugin-auth-backend-module-cloudflare-access-provider · fixed in 0.5.0