@backstage Plugin-catalog-backend vulnerabilities

• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106498 Fix available 7.7 HighOctober 6, 2026
• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Inconsistent catalog property permission evaluation CVE-2026-106497 4.3 MediumOctober 6, 2026
• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106496 Fix available 3.1 LowOctober 6, 2026
• backstage, @backstage plugin-catalog-backend-module-aws, plugin-catalog-backend-module-azure +3 more +5 more Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106493 Fix available 3.0 LowOctober 6, 2026
• @backstage plugin-catalog-backend-module-gitlab, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-gitlab +2 more Backstage: Improper authorization in GitLab organizational user ingestion CVE-2026-106463 Fix available 5.4 MediumOctober 6, 2026
• @backstage plugin-catalog-backend-module-bitbucket-server, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-bitbucket-server +2 more Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106458 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-catalog-backend-module-unprocessed, plugin-catalog-unprocessed-entities, plugin-catalog-unprocessed-entities-common +3 more +5 more Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks CVE-2026-44374 Fix available 4.3 MediumMay 6, 2026