CVE-2026-115923

Published 26 October 2026 · tracked since 27 October 2026

Description

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An au

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-72752 MEDIUM 6.5
• CVE-2026-50095 MEDIUM 6.1
• CVE-2026-116398 MEDIUM 6.5
• CVE-2026-116400 MEDIUM 6.5
• CVE-2026-115922 MEDIUM 6.2
• CVE-2026-115966 MEDIUM 6.5
• CVE-2026-115918 MEDIUM 6.5
• CVE-2026-115919 MEDIUM 6.2
• CVE-2026-115920 MEDIUM 6.2
• CVE-2026-115921 MEDIUM 6.2

→ Open the live CVE board · all tools