Advisories · Technology

backstage.

Every CVE that names backstage among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-106556 CVE record

CVSS 7.7 High

Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
- backstage
- @backstage plugin-techdocs-node
- Command injection
- CWE-184
Not analysed yet 7 Oct 2026
CVE-2026-106507 CVE record

CVSS 5.3 Medium

Backstage: TechDocs arbitrary file read via mkdocs snippets
- backstage
- plugin-techdocs-node
- Path traversal
- CWE-61
Not analysed yet 6 Oct 2026
CVE-2026-106497 CVE record

CVSS 4.3 Medium

Backstage: Inconsistent catalog property permission evaluation
- backstage
- @backstage plugin-catalog-backend
- Broken access control
- CWE-178
Not analysed yet 6 Oct 2026
CVE-2026-88064 CVE record

CVSS 8.8 High

Backstage: Improper input validation in TechDocs MkDocs configuration
- backstage
- Code injection
- CWE-20
Not analysed yet 16 Sept 2026