Backstage
54 CVEs tracked since 2021. Since Jun 2021, none of them reached CISA KEV.
Backstage CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-06 | 3 | 0 |
| 2021-07 | 2 or fewer | |
| 2021-08 | 3 or fewer | |
| 2021-09 | 2 or fewer | |
| 2021-10 | 2 or fewer | |
| 2021-11 | 2 | 0 |
| 2021-12 | 2 or fewer | |
| 2022-01 | 2 or fewer | |
| 2022-02 | 2 or fewer | |
| 2022-03 | 3 or fewer | |
| 2022-04 | 3 or fewer | |
| 2022-05 | 3 or fewer | |
| 2022-06 | 3 or fewer | |
| 2022-07 | 3 or fewer | |
| 2022-08 | 3 or fewer | |
| 2022-09 | 3 or fewer | |
| 2022-10 | 2 or fewer | |
| 2022-11 | 3 or fewer | |
| 2022-12 | 3 or fewer | |
| 2023-01 | 3 or fewer | |
| 2023-02 | 3 or fewer | |
| 2023-03 | no snapshot | |
| 2023-04 | 3 or fewer | |
| 2023-05 | 3 or fewer | |
| 2023-06 | 4 or fewer | |
| 2023-07 | 3 or fewer | |
| 2023-08 | 4 or fewer | |
| 2023-09 | 3 or fewer | |
| 2023-10 | 4 or fewer | |
| 2023-11 | 4 or fewer | |
| 2023-12 | 4 or fewer | |
| 2024-01 | 4 or fewer | |
| 2024-02 | 4 or fewer | |
| 2024-03 | 4 or fewer | |
| 2024-04 | 4 or fewer | |
| 2024-05 | 5 or fewer | |
| 2024-06 | 4 or fewer | |
| 2024-07 | 4 or fewer | |
| 2024-08 | 4 or fewer | |
| 2024-09 | 3 | 0 |
| 2024-10 | 4 or fewer | |
| 2024-11 | 4 or fewer | |
| 2024-12 | 3 or fewer | |
| 2025-01 | 4 or fewer | |
| 2025-02 | 3 or fewer | |
| 2025-03 | 5 or fewer | |
| 2025-04 | 4 or fewer | |
| 2025-05 | 4 or fewer | |
| 2025-06 | 4 or fewer | |
| 2025-07 | 5 or fewer | |
| 2025-08 | 4 or fewer | |
| 2025-09 | 4 or fewer | |
| 2025-10 | 4 or fewer | |
| 2025-11 | 4 or fewer | |
| 2025-12 | 5 or fewer | |
| 2026-01 | 5 | 0 |
| 2026-02 | 5 or fewer | |
| 2026-03 | 7 or fewer | |
| 2026-04 | 6 or fewer | |
| 2026-05 | 7 or fewer | |
| 2026-06 | 7 or fewer | |
| 2026-07 | 7 or fewer | |
| 2026-08 | 8 or fewer | |
| 2026-09 | 9 or fewer | |
| 2026-10 | 41 | 0 |
Products
The products that kept showing up in Backstage's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Backstage.
- CVE-2026-106495Backstage: Improper access control in backend action invocation4.3
- CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configuration7.7
- CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpoint5.3
- CVE-2026-106562Backstage: Incorrect authorization in search engine permission filtering4.3
- CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queries5.0
- CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend module7.1
- CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder module6.3
- CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configuration8.8
- CVE-2026-106556Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization7.7
- CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml7.7
- CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocs7.7
- CVE-2026-106508Backstage: Potential file exposure through local TechDocs publisher5.3
- CVE-2026-106507Backstage: TechDocs arbitrary file read via mkdocs snippets5.3
- CVE-2026-106506Backstage: Improper input validation in scaffolder task list ordering5.3
- CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend7.7
The record
- Peak rank
- #9 in Oct 2026
- Busiest month shown
- Oct 2026, 41 CVEs
- Months with a KEV entry
- 0 since Jun 2021
- Monthly snapshots
- 5 since 2021