CVE-2026-88899

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. This allows remote, unauthenticated attackers to supply arbitrary directory paths, enabling file operations outside the project root on the host system. The vulnera...

CVE-2026-88862

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

EUVD-2026-75412

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-88862

Capgo (capgo.app) backend through version 12.242.4 contains an authentication bypass in the API key manager via the x-limited-key-id header. The root cause is insufficient parent-child delegation validation in checkKeyByIdPg() within supabase/functions/_backend/utils/hono_middleware.ts. An authen...

CVE-2026-88862 Capgo API Key Manager Authentication Bypass via x-limited-key-id

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

CVE-2026-81635

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...

Exploit for CVE-2018-20062

CVE-2018-20062 ThinkPHP 5.0.23 - CVE-2018-20062 Impact Verif...

Exploit for CVE-2026-72815

CVE-2026-72815: go-chi/chi middleware.RealIP IP Spoofing PoC...

CVE-2026-88862: Incorrect Authorization

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...

CVE-2026-88899: External Control of File Name or Path

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88013: Exposure of Sensitive Information to an Unauthorized Actor

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

PT-2026-89477

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

PT-2026-89373

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/ backend/utils/hono middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and...

MikroTik RouterOS 7.0.x < 7.23.4 / 7.24.x < 7.24.2 X.509 Signature Validation Bypass (CVE-2026-67278)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by a certificate validation vulnerability. MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures duri...

golang.org/x/image: golang.org/x/image: Denial of Service due to excessive memory allocation when parsing malicious font files

A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted font file. Parsing this malicious file can lead to excessive memory allocation, which may result in a Denial of Service DoS for the affected system...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CVE-2026-82530

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

EUVD-2026-75018

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...

CVE-2026-82530 IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address...