https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:37:44 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-11510 bdu:2024-11510 https://cve.radiocsirt.org/vuln/bdu:2024-11510 https://cve.radiocsirt.org/vuln/euvd-2026-186174 EUVD-2026-186174 https://cve.radiocsirt.org/vuln/euvd-2026-186174 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45815 <p>Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend`. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend`. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45815 https://cve.radiocsirt.org/vuln/ghsa-3x3f-jcp3-g22j <p><strong>Affected:</strong> npm: @backstage/plugin-catalog-backend</p> <p>### Impact</p> <p>A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API.</p> <p>### Patches</p> <p>This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend` package.</p> <p>### References</p> <p>If you have any questions or comments about this advisory:</p> <p>Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)</p> <p><strong>Affected:</strong> npm: @backstage/plugin-catalog-backend</p> <p>### Impact</p> <p>A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API.</p> <p>### Patches</p> <p>This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend` package.</p> <p>### References</p> <p>If you have any questions or comments about this advisory:</p> <p>Open an issue in the [Backstage repository](https://github.com/backstage/backstage) Visit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)</p> https://cve.radiocsirt.org/vuln/ghsa-3x3f-jcp3-g22j https://cve.radiocsirt.org/vuln/rhba-2024:11265 <p>http-proxy-middleware: http-proxy-middleware: Denial of Service via unhandled error during path matching cross-spawn: regular expression denial of service path-to-regexp: Backtracking regular expressions cause ReDoS body-parser: Denial of Service Vulnerability in body-parser plugin-catalog-backend: prototype pollution vulnerability plugin-techdocs-backend: storage bucket directory traversal in TechDocs plugin-techdocs-backend: circumvention of XSS protection in TechDocs backstage/plugin-app-backend: Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend</p> <p>http-proxy-middleware: http-proxy-middleware: Denial of Service via unhandled error during path matching cross-spawn: regular expression denial of service path-to-regexp: Backtracking regular expressions cause ReDoS body-parser: Denial of Service Vulnerability in body-parser plugin-catalog-backend: prototype pollution vulnerability plugin-techdocs-backend: storage bucket directory traversal in TechDocs plugin-techdocs-backend: circumvention of XSS protection in TechDocs backstage/plugin-app-backend: Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend</p> https://cve.radiocsirt.org/vuln/rhba-2024:11265