CVE-2026-88862 Capgo API Key Manager Authentication Bypass via x-limited-key-id

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-88861 Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

CVE-2026-88861 Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

EUVD-2026-75411

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

CVE-2026-88861

Capgo (Cap-go/capgo.app), a continuous deployment platform, has an authentication bypass in all versions with no patched release available. The root cause is in the Edge authorization path: the JWT middleware (findJWT() in hono_middleware.ts) accepts tokens without validating their assurance leve...

CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2026-88860

Capgo , an OTA update platform, is affected by an authorization bypass caused by stale channel permission overrides. When a user's last organization role binding is deleted, Capgo fails to clean up associated channel-level permission overrides, leaving them active. An attacker with a previously r...

CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-88915

MISP ≤2.5.45 is affected by an authorization bypass in the event template instantiation path. When a template uses distribution = 4 , the template's sharing_group_id was passed directly into event creation without verifying that the acting user is permitted to use that sharing group via SharingGr...

CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...

CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...

CVE-2026-88915 MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution = 4, the template can specify a sharinggroupid. The instantiation path passed that value into event creation without verifying that the user...

CVE-2026-85545

HikCentral Access Control is affected by a broken access control vulnerability in some unspecified versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access, representing an authorization bypass. The vulnerability is exploitable over the net...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

DEBIAN-CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence AI to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and...

CVE-2026-88859 Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

EUVD-2026-75397

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...