https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-106498.htmlhttps://patchthecve.com/cve/CVE-2026-106498.htmlFri, 16 Oct 2026 15:22:13 +0000HIGH 7.7: Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity wihttps://patchthecve.com/cve/CVE-2026-106497.htmlhttps://patchthecve.com/cve/CVE-2026-106497.htmlFri, 16 Oct 2026 15:26:26 +0000MEDIUM 4.3: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, ahttps://patchthecve.com/cve/CVE-2026-106496.htmlhttps://patchthecve.com/cve/CVE-2026-106496.htmlFri, 16 Oct 2026 15:33:47 +0000LOW 3.1: Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain configurations, the catalog backend could process location types tha