CVE Vulnerability Catalog

In Backstage prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

The @backstage/plugin-kubernetes-backend package prior to 0.21.9 allows an authenticated user with standard Kubernetes resource read permission to retrieve sensitive values that the plugin is designed to mask. This can expose credentials and other confidential material held in connected clusters, limited to resources the Backstage service account is permitted to read.

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.

The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to 0.3.25 is affected by improper input validation in the Confluence to Markdown scaffolder module. This could allow an attacker to influence file write operations during template execution if a Backstage user runs a template that processes attacker-influenced Confluence content.

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container.

Backstage, an open framework for building developer portals, prior to version 1.14.6 contains a remote code execution vulnerability in the @backstage/plugin-techdocs-node package. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml with markdown_extensions, causing arbitrary OS command execution on the TechDocs build host. This issue is fixed in versions 1.14.6 and 1.15.4.

A heap-based buffer overflow exists in GIMP's GIF export plug-in. Exporting an image with very large width and height can cause a 32-bit overflow when computing the pixel buffer size, leading to an integer overflow and a mismatch between allocation and actual write by GEGL.

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, the cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user-supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, the cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

In NTFS-3G before 2026.7.7, an out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information from ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.