Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 23:36:41 +0000 EUVD-2026-384060 https://cve.radiocsirt.org/vuln/euvd-2026-384060 EUVD-2026-384060 https://cve.radiocsirt.org/vuln/euvd-2026-384060 fkie_cve-2026-106496 https://cve.radiocsirt.org/vuln/fkie_cve-2026-106496 <p>Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1.</p> <p>Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. This issue is fixed in version 3.9.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-106496 GHSA-pcmq-25r3-5w9v — Backstage: Inconsistent enforcement of allowed location types during catalog processing https://cve.radiocsirt.org/vuln/ghsa-pcmq-25r3-5w9v <p><strong>Affected:</strong> npm: @backstage/plugin-catalog-backend</p> <p>### Impact</p> <p>Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-catalog-backend` version `3.9.1`</p> <p>### Workarounds</p> <p>No practical workarounds are available. Upgrade to the patched version.</p> <p><strong>Affected:</strong> npm: @backstage/plugin-catalog-backend</p> <p>### Impact</p> <p>Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.</p> <p>### Patches</p> <p>Patched in `@backstage/plugin-catalog-backend` version `3.9.1`</p> <p>### Workarounds</p> <p>No practical workarounds are available. Upgrade to the patched version.</p> https://cve.radiocsirt.org/vuln/ghsa-pcmq-25r3-5w9v