EUVD-2026-38749

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs...

CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs...

CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs...

CVE-2026-56302 Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs...

EUVD-2026-38744

Capgo before 12.128.2 allows direct patching of public.apps.ownerorg through PostgREST, bypassing the transferapp workflow and creating split-brain ownership. Attackers can directly update apps.ownerorg while leaving appversions.ownerorg unchanged, enabling old-org keys to retain access to versio...

CVE-2026-56257 Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update

Capgo before 12.128.2 allows direct patching of public.apps.ownerorg through PostgREST, bypassing the transferapp workflow and creating split-brain ownership. Attackers can directly update apps.ownerorg while leaving appversions.ownerorg unchanged, enabling old-org keys to retain access to versio...

CVE-2026-56232 Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header

Capgo before 12.128.2 fails to enforce limitedtoorgs and limitedtoapps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the...

CVE-2026-56231 Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter

Capgo before 12.128.2 contains a broken object level authorization BOLA vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled appid supplied in the request body and never verify that the jobI...

CVE-2026-56231

Capgo prior to 12.128.2 contains a broken object level authorization (BOLA) in build endpoints: POST /build/start/:jobId and POST /build/cancel/:jobId. The handlers validate only the attacker-controlled app_id in the request body and fail to verify that the URL jobId belongs to the same app/tenan...

EUVD-2026-38738

Capgo before 12.128.2 contains a broken object level authorization BOLA vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled appid supplied in the request body and never verify that the jobI...

CVE-2026-56231

Capgo before 12.128.2 contains a broken object level authorization BOLA vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled appid supplied in the request body and never verify that the jobI...

CVE-2026-9539

creationtimestamp| type| source ---|---|--- 2026-06-24 07:49:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mozgj7ilkh25 2026-08-26 20:00:03+00:00| published-proof-of-concept| Telegram/w88JAgQvKlIS1J4oBmOAFdoduZjdWNxY21QnJAdfIJUY 2026-08-27 00:00:08+00:00|...

CVE-2022-28209

creationtimestamp| type| source ---|---|--- 2026-06-24 07:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mozfsnt7gj24...

CVE-2026-11807

creationtimestamp| type| source ---|---|--- 2026-06-24 00:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/116802141319916316 2026-06-24 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3moymcgce3a2j 2026-06-25 15:00:21+00:00| seen|...

CVE-2026-49269

Apple M1 GPUs suffer from a vulnerability where register file data is retained between compute shader dispatches from different processes. A sandboxed Metal attacker app can execute a GPU reader shader to access stale register values left by a separate sandboxed victim application. In a demonstra...

PT-2026-51767

Capgo before 12.128.2 fails to enforce limited to orgs and limited to apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the...

CVE-2026-12958

creationtimestamp| type| source ---|---|--- 2026-06-23 17:49:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxxlivovf2n 2026-06-25 14:56:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mp4otnuzjr2v 2026-06-26 19:45:27+00:00| seen|...

GHSA-8QV3-P479-CJ62 Budibase has nonymous NoSQL operator injection via published-app query templates

Summary enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138 substitutes parameter values into the raw JSON body of a query, then JSON.parses the result. The validator validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 rejects only Handlebars...

PYSEC-2026-223

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an...

CVE-2026-56225

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...