Linuxfoundation

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 9.8CriticalOct 13, 2026Linuxfoundation vitess XSSCVE-2026-104252Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping. Under the default allow-all ACL policy, a remote unauthenticated attacker can send an operator a crafted request that executes script in the operator's browser after the request is opened. The script
• 8.5HighOct 6, 2026Linuxfoundation backstage\/plugin-scaffolder-backend-module-bitbucket-cloud Path traversal / file handlingCVE-2026-106486Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising back
• 4.3MediumOct 6, 2026Linuxfoundation backstage\/plugin-scaffolder-backend Auth bypass / access controlCVE-2026-106461Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0
• 6.8MediumOct 6, 2026Linuxfoundation backstage\/plugin-auth-node Auth bypass / access controlCVE-2026-106460Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalization. The affected paths include a selected profile email marked verified: false, a matching raw provider email marked email_verified: false, and an email obtained only from an ID token marked email_verified: false. Exploitation requires an admitted identity-pr
• 6.5MediumOct 6, 2026Linuxfoundation backstage\/plugin-catalog-backend-module-bitbucket-server Auth bypass / access controlCVE-2026-106458Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbuc
• 6.8MediumOct 6, 2026Linuxfoundation backstage\/plugin-auth-backend-module-cloudflare-access-provider Auth bypass / access controlCVE-2026-106457Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access auth provider. The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same C
• 4.8MediumOct 6, 2026Linuxfoundation backstage\/plugin-proxy-backend Auth bypass / access controlCVE-2026-106456Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may the
• 5.3MediumJul 1, 2026Linuxfoundation opentelemetry instrumentation for java Denial of serviceCVE-2026-54712OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive memory allocation while the JVM reads the payload, poten
• 6.5MediumJul 1, 2026Linuxfoundation opentelemetry instrumentation for java Information disclosureCVE-2026-54704OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0.

See every Linuxfoundation entry on the dashboard.

Top products

• opentelemetry instrumentation for java2 CVEs in the last year
• vitess1 CVE in the last year, 1 critical
• backstage\/plugin-scaffolder-backend-module-bitbucket-cloud1 CVE in the last year
• backstage\/plugin-scaffolder-backend1 CVE in the last year
• backstage\/plugin-proxy-backend1 CVE in the last year
• backstage\/plugin-catalog-backend-module-bitbucket-server1 CVE in the last year
• backstage\/plugin-auth-node1 CVE in the last year
• backstage\/plugin-auth-backend-module-cloudflare-access-provider1 CVE in the last year