Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filtersBackstage: Improper input validation in Confluence to Markdown scaffolder module
Backstage: Improper repository path validation in a Scaffolder backend module
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Backstage: Sensitive information exposure in Scaffolder
Backstage: Secret-derived values may be exposed in scaffolder task logs
Backstage: Scaffolder action input authorization bypass
Backstage: Improper task state validation in Scaffolder backend
Backstage: Incorrect authorization in scaffolder task listing
Backstage may expose sensitive information in Scaffolder task failure events
Backstage has sensitive information exposure in scaffolder task logs
Backstage has improper input validation in scaffolder task list ordering
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Template Secret leakage in logs in Scaffolder when using `fetch:template`
Backstage Scaffolder plugin has insecure sandbox
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Path Traversal in @backstage/plugin-scaffolder-backend
Path Traversal in @backstage/plugin-scaffolder-backend
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.