Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,458
Reset filtersBackstage: Improper repository path validation in a Scaffolder backend module
Backstage has incorrect authorization in search engine permission filtering
Backstage: Improper entity validation in deprecated Kubernetes services endpoint
Backstage has a sensitive information disclosure in Kubernetes resource queries
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage has improper authorization in GitLab organizational user ingestion
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Backstage: Improper authentication in the OIDC provider
Backstage: Improper authorization enforcement for TechDocs static content
Backstage: Improper input validation in TechDocs static content requests
Backstage: Cloud storage catalog locations may cross configured storage boundaries
Backstage: Improper input validation in proxy-backend
Backstage: Improper preservation of access restrictions during service credential delegation
Backstage: Improper input validation in cloud storage URL readers
Backstage: Inconsistent enforcement of allowed location types during catalog processing
Backstage: Improper URL validation in catalog entity placeholder resolution
Backstage: Sensitive information exposure in Scaffolder
Backstage: Secret-derived values may be exposed in scaffolder task logs
Backstage: Scaffolder action input authorization bypass
Backstage: Improper task state validation in Scaffolder backend
Backstage: Incorrect authorization in scaffolder task listing
Backstage may expose sensitive information in Scaffolder task failure events
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.