Vendor

backstage

73 known vulnerabilities.

Products

backstage 69 plugin-scaffolder-backend 10 plugin-techdocs-node 8 plugin-catalog-backend 3 backend-defaults 3 plugin-kubernetes-backend 3 plugin-auth-backend 2 plugin-techdocs-backend 2 plugin-scaffolder-backend-module-confluence-to-markdown 2 plugin-proxy-backend 2 plugin-scaffolder-backend-module-bitbucket-cloud 2 plugin-scaffolder-backend-module-bitbucket-server 2 plugin-catalog-backend-module-azure 1 plugin-catalog-backend-module-aws 1 plugin-auth-backend-module-cloudflare-access-provider 1 plugin-catalog-backend-module-unprocessed 1 plugin-catalog-unprocessed-entities 1 plugin-catalog-unprocessed-entities-common 1 plugin-search-backend 1 plugin-search-backend-module-elasticsearch 1 plugin-auth-node 1 plugin-catalog-backend-module-bitbucket-server 1 plugin-scaffolder-backend-module-sentry 1 plugin-catalog-backend-module-gitlab 1 plugin-scaffolder-backend-module-azure 1 plugin-scaffolder-backend-module-github 1 plugin-scaffolder-backend-module-gitlab 1 plugin-auth-backend-module-oidc-provider 1

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.6

CVE-2026-106501

Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read a…

backstage backstage plugin-scaffolder-backend @backstage/plugin-scaffolder-backend npm

Oct 6, 2026