CVE-2026-73563 | Medium | 4.7 | 2026-08-13 | Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document fe… |
CVE-2026-29186 | High | 7.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary cod… |
CVE-2026-29185 | Low | 2.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations a… |
CVE-2026-29184 | Low | 2.0 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism t… |
CVE-2026-25153 | High | 7.7 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-25152 | Medium | 5.3 | 2026-01-30 | Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In ver… |
CVE-2026-24048 | Low | 3.5 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Ba… |
CVE-2026-24047 | Medium | 6.3 | 2026-01-21 | Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command… |
CVE-2026-24046 | High | 7.1 | 2026-01-21 | Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based pa… |
CVE-2025-55285 | Low | 2.6 | 2025-08-15 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values… |
CVE-2025-32791 | Medium | 4.3 | 2025-04-16 | The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend… |
CVE-2024-53983 | Medium | 5.4 | 2024-11-29 | The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder templ… |
CVE-2024-47762 | Medium | 5.8 | 2024-10-03 | Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backen… |
CVE-2024-46976 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject execu… |
CVE-2024-45816 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in t… |
CVE-2024-45815 | Medium | 6.5 | 2024-09-17 | Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plu… |
CVE-2024-26150 | High | 8.7 | 2024-02-23 | `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backe… |
CVE-2023-35926 | High | 8.0 | 2023-06-22 | Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by… |
CVE-2023-25571 | Medium | 6.8 | 2023-02-14 | Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4… |
CVE-2021-43783 | High | 8.5 | 2021-11-29 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor with write access to a… |
CVE-2021-43776 | High | 7.4 | 2021-11-26 | Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into… |
CVE-2021-41151 | Medium | 6.8 | 2021-10-18 | Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaf… |
CVE-2021-32662 | Medium | 6.5 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/tech… |
CVE-2021-32661 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malic… |
CVE-2021-32660 | Medium | 6.8 | 2021-06-03 | Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@ba… |