PL
Product
plugin-scaffolder-backend
9
CVEs
0
On KEV
9.6
Max CVSS
9
New 30D
Severity mix
Critical 1High 2Medium 6Low 0
Watch
Add plugin-scaffolder-backend to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-106501 | 9.6 | Oct 6 | Backstage: Sensitive information exposure in Scaffolder Affected: < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 |
| CVE-2026-106500 | 8.5 | Oct 6 | Backstage: Improper task state validation in Scaffolder backend Affected: < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 |
| CVE-2026-106503 | 8.1 | Oct 6 | Backstage: Scaffolder action input authorization bypass Affected: < 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 |
| CVE-2026-106504 | 6.5 | Oct 6 | Backstage: Sensitive information exposure in scaffolder task logs Affected: < 4.1.0 |
| CVE-2026-106462 | 6.4 | Oct 6 | Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback Affected: < 4.1.0 |
| CVE-2026-106506 | 5.3 | Oct 6 | Backstage: Improper input validation in scaffolder task list ordering Affected: < 4.1.0 |
| CVE-2026-106502 | 5.3 | Oct 6 | Backstage: Sensitive information may be exposed in Scaffolder task failure events Affected: < 4.1.0 |
| CVE-2026-106499 | 4.9 | Oct 6 | Backstage: Secret-derived values may be exposed in scaffolder task logs Affected: < 4.1.0 |
| CVE-2026-106461 | 4.3 | Oct 6 | Backstage: Incorrect authorization in scaffolder task listing Affected: < 4.1.0 |
Showing 9