Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,474
Reset filtersBackstage: Improper authentication in the OIDC provider
Backstage: Improper authorization enforcement for TechDocs static content
Backstage: Improper input validation in TechDocs static content requests
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Backstage: Improper input validation in proxy-backend
Backstage: Improper preservation of access restrictions during service credential delegation
Backstage: Improper input validation in cloud storage URL readers
Backstage: Inconsistent enforcement of allowed location types during catalog processing
Backstage: Improper URL validation in catalog entity placeholder resolution
Backstage: Sensitive information exposure in Scaffolder
Backstage: Secret-derived values may be exposed in scaffolder task logs
Backstage: Scaffolder action input authorization bypass
Backstage: Improper task state validation in Scaffolder backend
Backstage: Incorrect authorization in scaffolder task listing
Backstage may expose sensitive information in Scaffolder task failure events
Backstage has sensitive information exposure in scaffolder task logs
Backstage has improper input validation in scaffolder task list ordering
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Backstage has potential file exposure through local TechDocs publisher
Backstage: Improper validation of MkDocs theme configuration in TechDocs
Backstage has improper input validation in TechDocs Markdown extension configuration
Payload: Field-level write access bypass in Payload on MongoDB
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.