OSV.dev (GitHub Advisories, PyPA, Go, RustSec…)

38,604 results · Feed

• High 7.8
  CVE-2026-106442

  Hydra instantiate target blacklist bypasses permit code execution

  Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. Execution wra…

  hydra-ecosystem hydra hydra-core PyPI
  Oct 6, 2026
• High 7.5
  CVE-2026-104891

  mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

  mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, ch…

  douglasborthwick-crypto @insumermodel mppx-token-gate mppx-condition-gate npm
  Oct 5, 2026
• High 7.7
  CVE-2026-106510

  Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

  Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register cat…

  backstage backstage plugin-techdocs-node @backstage/plugin-techdocs-node npm
  Oct 7, 2026
• High 8.8
  CVE-2026-106558

  Backstage: Improper validation of TechDocs MkDocs configuration

  Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or …

  backstage backstage plugin-techdocs-node @backstage/plugin-techdocs-node npm
  Oct 7, 2026
• Medium 6.3
  CVE-2026-106559

  Backstage: Improper input validation in Confluence to Markdown scaffolder module

  Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient i…

  backstage backstage plugin-scaffolder-backend-module-confluence-to-markdown @backstage/plugin-scaffolder-backend-module-confluence-to-markdown Web / CMS npm
  Oct 7, 2026
• High 7.1
  CVE-2026-106560

  Backstage: Improper repository path validation in a Scaffolder backend module

  Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated …

  backstage backstage plugin-scaffolder-backend-module-confluence-to-markdown @backstage/plugin-scaffolder-backend-module-confluence-to-markdown Web / CMS npm
  Oct 7, 2026
• Medium 4.3
  CVE-2026-106562

  Backstage: Incorrect authorization in search engine permission filtering

  Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. A…

  backstage backstage plugin-search-backend plugin-search-backend-module-elasticsearch npm
  Oct 7, 2026
• Medium 5.3
  CVE-2026-106563

  Backstage: Improper entity validation in deprecated Kubernetes services endpoint

  Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read p…

  backstage backstage plugin-kubernetes-backend @backstage/plugin-kubernetes-backend npm
  Oct 7, 2026
• Medium 5.0
  CVE-2026-106561

  Backstage: Sensitive information disclosure in Kubernetes resource queries

  Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kuberne…

  backstage backstage plugin-kubernetes-backend @backstage/plugin-kubernetes-backend npm
  Oct 7, 2026
• Medium 6.4
  CVE-2026-106462

  Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback

  Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integra…

  backstage backstage plugin-scaffolder-backend plugin-scaffolder-backend-module-bitbucket-cloud Web / CMS npm
  Oct 6, 2026
• Medium 5.4
  CVE-2026-106463

  Backstage: Improper authorization in GitLab organizational user ingestion

  Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organizati…

  backstage backstage plugin-catalog-backend-module-gitlab @backstage/plugin-catalog-backend-module-gitlab Web / CMS npm
  Oct 6, 2026
• High 8.5
  CVE-2026-106486

  Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

  Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder act…

  backstage backstage plugin-scaffolder-backend-module-bitbucket-server plugin-scaffolder-backend-module-bitbucket-cloud npm
  Oct 6, 2026
• Low 3.5
  CVE-2026-106487

  Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

  Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery…

  backstage backstage plugin-kubernetes-backend @backstage/plugin-kubernetes-backend npm
  Oct 6, 2026
• High 8.1
  CVE-2026-106488

  Backstage: Improper authentication in the OIDC provider

  Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugin-auth-backend-module-oidc-provider package is affected by improper authentication in the oidc provider. Deployments using OIDC email-based identity resolution…

  backstage backstage plugin-auth-backend-module-oidc-provider @backstage/plugin-auth-backend-module-oidc-provider npm
  Oct 6, 2026
• Medium 6.5
  CVE-2026-106489

  Backstage: Improper authorization enforcement for TechDocs static content

  Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs docu…

  backstage backstage plugin-techdocs-backend @backstage/plugin-techdocs-backend npm
  Oct 6, 2026
• Medium 6.5
  CVE-2026-106490

  Backstage: Improper input validation in TechDocs static content requests

  Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenti…

  backstage backstage plugin-techdocs-backend @backstage/plugin-techdocs-backend npm
  Oct 6, 2026
• Low 3.0
  CVE-2026-106493

  Backstage: Cloud storage catalog locations may cross configured storage boundaries

  Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog sourc…

  backstage backstage plugin-catalog-backend-module-azure plugin-catalog-backend-module-aws npm
  Oct 6, 2026
• Medium 6.4
  CVE-2026-106491

  Backstage: Improper input validation in proxy-backend

  Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the pr…

  backstage backstage plugin-proxy-backend @backstage/plugin-proxy-backend npm
  Oct 6, 2026
• High 7.6
  CVE-2026-106492

  Backstage: Improper preservation of access restrictions during service credential delegation

  Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential…

  backstage backstage backend-defaults @backstage/backend-defaults npm
  Oct 6, 2026
• Medium 4.4
  CVE-2026-106494

  Backstage: Improper input validation in cloud storage URL readers

  Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Back…

  backstage backstage backend-defaults @backstage/backend-defaults npm
  Oct 6, 2026
• Low 3.1
  CVE-2026-106496

  Backstage: Inconsistent enforcement of allowed location types during catalog processing

  Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog…

  backstage backstage plugin-catalog-backend @backstage/plugin-catalog-backend npm
  Oct 6, 2026
• High 7.7
  CVE-2026-106498

  Backstage: Improper URL validation in catalog entity placeholder resolution

  Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backs…

  backstage backstage plugin-catalog-backend @backstage/plugin-catalog-backend npm
  Oct 6, 2026
• Critical 9.6
  CVE-2026-106501

  Backstage: Sensitive information exposure in Scaffolder

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read a…

  backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm
  Oct 6, 2026
• Medium 4.9
  CVE-2026-106499

  Backstage: Secret-derived values may be exposed in scaffolder task logs

  Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secr…

  backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm
  Oct 6, 2026
• High 8.1
  CVE-2026-106503

  Backstage: Scaffolder action input authorization bypass

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected …

  backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm
  Oct 6, 2026
• High 8.5
  CVE-2026-106500

  Backstage: Improper task state validation in Scaffolder backend

  Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission …

  backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm
  Oct 6, 2026
• Medium 4.3
  CVE-2026-106461

  Backstage: Incorrect authorization in scaffolder task listing

  Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for …

  backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm
  Oct 6, 2026
• Medium 5.3
  CVE-2026-107262

  Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

  Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

  Drupal Advanced Filesystem drupal/advanced_filesystem Packagist
  Oct 30, 2026
• High 7.3
  CVE-2026-107255

  Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

  Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

  Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  Oct 30, 2026
• Medium 4.3
  CVE-2026-107312

  Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

  Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

  Drupal Examples for Developers drupal/examples Packagist
  Oct 30, 2026
• Low 3.7
  CVE-2026-107311

  Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

  Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

  Drupal Permissions by Term drupal/permissions_by_term Packagist
  Oct 30, 2026
• Medium 4.3
  CVE-2026-107310

  Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

  Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

  Drupal Freelinking drupal/freelinking Packagist
  Oct 30, 2026
• Low 3.7
  CVE-2026-107309

  Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

  Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

  Drupal Easy Breadcrumb drupal/easy_breadcrumb Packagist
  Oct 30, 2026
• Low 3.1
  CVE-2026-107308

  Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

  Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

  Drupal Country drupal/country Packagist
  Oct 30, 2026
• Medium 4.3
  CVE-2026-107307

  SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

  Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

  Drupal SmartLinker AI drupal/smartlinker_ai Packagist
  Oct 30, 2026
• Low 3.8
  CVE-2026-107306

  Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

  Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

  Drupal Menu Link Attributes drupal/menu_link_attributes Packagist
  Oct 30, 2026
• Medium 5.3
  CVE-2026-107267

  DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

  Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

  Drupal DKAN drupal/dkan Packagist
  Oct 30, 2026
• Medium 4.3
  CVE-2026-107268 Public exploit

  Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

  Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

  Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  Oct 30, 2026
• Medium 6.5
  CVE-2026-96389

  Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

  Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

  Drupal Xray Audit drupal/xray_audit Packagist
  Oct 30, 2026
• Medium 5.3
  CVE-2026-107266

  Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

  Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

  Drupal Views Share drupal/views_share Packagist
  Oct 30, 2026