Linuxfoundation vulnerabilities

Products

• Yocto 115
• Backstage 53
• Nats-server 36
• Pytorch 31
• Everest 29
• Harbor 24
• Containerd 22
• Magma 22
• Runc 17
• Iot-yocto 15
• Cups-filters 14
• Dragonfly 13
• Onnx 12
• Backstage\/plugin-scaffolder-backend 11
• Open Network Operating System 11
• Backstage Plugin-techdocs-node 10
• Spinnaker 10
• Ceph 8
• Kubeedge 8
• Tekton Pipelines 8
• Cubefs 6
• Edge Virtualization Engine 6
• Vitess 6
• Argo-cd 5
• Automotive Grade Linux 5
• Foomatic-filters 5
• Opendaylight 5
• Osquery 5
• Backstage Plugin-catalog-backend 4
• Cortex 4
• Dex 4
• Grpc Swift 4
• Indy-node 4
• Materialx 4
• Opentelemetry Instrumentation For Java 4
• Rekor 4
• The Update Framework 4
• Zowe Api Mediation Layer 4
• Backstage\/plugin-kubernetes-backend 3
• Besu 3

Show 25 moreShow less

• Inspektor Gadget 3
• Kedro 3
• Sigstore Timestamp Authority 3
• Antrea 2
• Backstage\/backend-defaults 2
• Backstage\/backend Defaults 2
• Backstage\/plugin-proxy-backend 2
• Backstage\/plugin-scaffolder-backend-module-bitbucket-cloud 2
• Backstage\/plugin-scaffolder-backend-module-bitbucket-server 2
• Backstage\/plugin-scaffolder-backend-module-confluence-to-markdown 2
• Backstage\/plugin-techdocs-backend 2
• Cni Network Plugins 2
• Dapr 2
• Dojo 2
• Dojox 2
• Fabric 2
• Fluid 2
• Fulcio 2
• Longhorn 2
• Onos-kpimon 2
• Onos-lib-go 2
• Podman Desktop 2
• Software For Open Networking In The Cloud 2
• Strimzi 2
• Tremor-script 2

Newest

• linuxfoundation vitess Vitess vttablet /twopcz reflected XSS CVE-2026-104252 Fix available 9.8 CriticalOctober 13, 2026
• @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 more Backstage: Improper entity validation in deprecated Kubernetes services endpoint CVE-2026-106563 Fix available 5.3 MediumOctober 7, 2026
• @backstage plugin-search-backend, plugin-search-backend-module-elasticsearch, backstage +2 more +4 more Backstage: Incorrect authorization in search engine permission filtering CVE-2026-106562 Fix available 4.3 MediumOctober 7, 2026
• @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 more Backstage: Sensitive information disclosure in Kubernetes resource queries CVE-2026-106561 Fix available 5.0 MediumOctober 7, 2026
• @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 more Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106560 Fix available 7.1 HighOctober 7, 2026
• @backstage plugin-scaffolder-backend-module-confluence-to-markdown, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-confluence-to-markdown +2 more Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106559 Fix available 6.3 MediumOctober 7, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Improper validation of TechDocs MkDocs configuration CVE-2026-106558 Fix available 8.8 HighOctober 7, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization CVE-2026-106556 7.7 HighOctober 7, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml CVE-2026-106510 Fix available 7.7 HighOctober 7, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Improper validation of MkDocs theme configuration in TechDocs CVE-2026-106509 Fix available 7.7 HighOctober 6, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Potential file exposure through local TechDocs publisher CVE-2026-106508 Fix available 5.3 MediumOctober 6, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: TechDocs arbitrary file read via mkdocs snippets CVE-2026-106507 5.3 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper input validation in scaffolder task list ordering CVE-2026-106506 Fix available 5.3 MediumOctober 6, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend CVE-2026-106505 Fix available 7.7 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information exposure in scaffolder task logs CVE-2026-106504 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Scaffolder action input authorization bypass CVE-2026-106503 Fix available 8.1 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information may be exposed in Scaffolder task failure events CVE-2026-106502 Fix available 5.3 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Sensitive information exposure in Scaffolder CVE-2026-106501 Fix available 9.6 CriticalOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper task state validation in Scaffolder backend CVE-2026-106500 Fix available 8.5 HighOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106499 Fix available 4.9 MediumOctober 6, 2026
• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106498 Fix available 7.7 HighOctober 6, 2026
• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Inconsistent catalog property permission evaluation CVE-2026-106497 4.3 MediumOctober 6, 2026
• @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 more Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106496 Fix available 3.1 LowOctober 6, 2026
• @backstage backend-defaults, backstage, linuxfoundation backstage\/backend defaults +2 more Backstage: Improper input validation in cloud storage URL readers CVE-2026-106494 Fix available 4.4 MediumOctober 6, 2026
• backstage, @backstage plugin-catalog-backend-module-aws, plugin-catalog-backend-module-azure +3 more +5 more Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106493 Fix available 3.0 LowOctober 6, 2026
• @backstage backend-defaults, backstage, linuxfoundation backstage\/backend-defaults +2 more Backstage: Improper preservation of access restrictions during service credential delegation CVE-2026-106492 Fix available 7.6 HighOctober 6, 2026
• @backstage plugin-proxy-backend, backstage, linuxfoundation backstage\/plugin-proxy-backend +2 more Backstage: Improper input validation in proxy-backend CVE-2026-106491 Fix available 6.4 MediumOctober 6, 2026
• @backstage plugin-techdocs-backend, backstage, linuxfoundation backstage\/plugin-techdocs-backend +2 more Backstage: Improper input validation in TechDocs static content requests CVE-2026-106490 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-techdocs-backend, backstage, linuxfoundation backstage\/plugin-techdocs-backend +2 more Backstage: Improper authorization enforcement for TechDocs static content CVE-2026-106489 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-auth-backend-module-oidc-provider, backstage, linuxfoundation backstage\/plugin-auth-backend-module-oidc-provider +2 more Backstage: Improper authentication in the OIDC provider CVE-2026-106488 Fix available 8.1 HighOctober 6, 2026
• @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 more Backstage: Unsupported catalog cluster authentication mode in kubernetes backend CVE-2026-106487 Fix available 3.5 LowOctober 6, 2026
• @backstage plugin-scaffolder-backend-module-bitbucket-cloud, plugin-scaffolder-backend-module-bitbucket-server, backstage +2 more +4 more Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106486 Fix available 8.5 HighOctober 6, 2026
• @backstage plugin-catalog-backend-module-gitlab, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-gitlab +2 more Backstage: Improper authorization in GitLab organizational user ingestion CVE-2026-106463 Fix available 5.4 MediumOctober 6, 2026
• backstage, @backstage plugin-scaffolder-backend, plugin-scaffolder-backend-module-azure +10 more +12 more Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106462 Fix available 6.4 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106461 Fix available 4.3 MediumOctober 6, 2026
• @backstage plugin-auth-node, backstage, linuxfoundation backstage\/plugin-auth-node +2 more Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization CVE-2026-106460 Fix available 6.8 MediumOctober 6, 2026
• @backstage plugin-scaffolder-backend-module-sentry, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry +2 more Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106459 Fix available 8.5 HighOctober 6, 2026
• @backstage plugin-catalog-backend-module-bitbucket-server, backstage, linuxfoundation backstage\/plugin-catalog-backend-module-bitbucket-server +2 more Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106458 Fix available 6.5 MediumOctober 6, 2026
• @backstage plugin-auth-backend-module-cloudflare-access-provider, backstage, linuxfoundation backstage\/plugin-auth-backend-module-cloudflare-access-provider +2 more Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106457 Fix available 6.8 MediumOctober 6, 2026
• @backstage plugin-proxy-backend, backstage, linuxfoundation backstage\/plugin-proxy-backend +2 more Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106456 Fix available 4.8 MediumOctober 6, 2026
• @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Improper validation of MkDocs plugin configuration in TechDocs CVE-2026-106455 Fix available 7.7 HighOctober 6, 2026
• backstage, linuxfoundation backstage plugin-techdocs-node +1 more Backstage: Improper input validation in TechDocs MkDocs configuration CVE-2026-88064 8.8 HighSeptember 16, 2026
• linuxfoundation vitess Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVE-2026-65959 Fix available 5.3 MediumAugust 18, 2026
• backstage, linuxfoundation backstage\/plugin-auth-backend +1 more Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend` CVE-2026-73563 Fix available 4.7 MediumJuly 24, 2026
• linuxfoundation torchvision, pytorch vision +1 more PyTorch torchvision GIF Decoder Out-of-bounds Heap Read CVE-2026-65918 7.1 HighJuly 23, 2026
• cert-manager cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials CVE-2026-62290 Fix available 7.3 HighJuly 16, 2026
• linuxfoundation spinnaker Spinnaker: Improper yaml processing on kustomize bake operations CVE-2026-55175 Fix available 7.5 HighJuly 10, 2026
• linuxfoundation nats-server NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled CVE-2026-58208 Fix available 6.8 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions CVE-2026-58211 Fix available 5.4 MediumJuly 8, 2026
• linuxfoundation nats-server NATS Server: Remote crash via integer overflow in Connz pagination CVE-2026-58207 Fix available 7.7 HighJuly 8, 2026
• Show olderLoading…