CVE Tools
Track your stack

Backstage

71 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Backstage, a product in the ai ml space. Use it to gauge the current risk picture and drill into individual advisories.

Backstage CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Backstage CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-070
2025-081
2025-090
2025-100
2025-110
2025-120
2026-015
2026-020
2026-035
2026-040
2026-050
2026-060
2026-070
2026-081
2026-091
2026-1042

Severity

How the 71 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical11%
  • High2434%
  • Medium3955%
  • Low710%

Latest CVEs

The 15 most recently published vulnerabilities affecting Backstage.

  1. CVE-2026-106495Backstage: Improper access control in backend action invocation4.3
  2. CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configuration7.7
  3. CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpoint5.3
  4. CVE-2026-106562Backstage: Incorrect authorization in search engine permission filtering4.3
  5. CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queries5.0
  6. CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend module7.1
  7. CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder module6.3
  8. CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configuration8.8
  9. CVE-2026-106556Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization7.7
  10. CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml7.7
  11. CVE-2026-106509Backstage: Improper validation of MkDocs theme configuration in TechDocs7.7
  12. CVE-2026-106508Backstage: Potential file exposure through local TechDocs publisher5.3
  13. CVE-2026-106507Backstage: TechDocs arbitrary file read via mkdocs snippets5.3
  14. CVE-2026-106506Backstage: Improper input validation in scaffolder task list ordering5.3
  15. CVE-2026-106505Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend7.7

Product grouping is registry-driven, with AI assist and human review. How it works