60185 matches found
CVE-2026-56248
Cap-go capgo (capgo-backend) before 12.128.12 is affected. An unauthenticated DoS arises from the audit_logs table RLS policy when accessed via the Supabase PostgREST API; the query planner performs costly work before RLS rejection, so unfiltered public.audit_logs queries with the public anon key...
CVE-2026-56248 Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...
CVE-2026-56248
Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...
CVE-2026-56243 Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...
EUVD-2026-38430
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...
CVE-2026-56243
Capgo before 12.128.2 has a security control bypass in the PostgREST/RLS plane: it accepts plaintext API keys via the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext keys directly to the PostgREST/RLS plane t...
CVE-2026-56225
Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...
CVE-2026-56225 Capgo - Authorization Bypass in API Key Management via App-Limited Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Using the “after free” mechanism in the Digital Credentials API in Google Chrome before version 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
CVE-2026-9678 vulnerabilities
Vulnerabilities for packages: gemini-cli, renovate, langfuse, code-server, langfuse-fips, kibana, vitess, py3-captum, pelias-api...
CVE-2026-9697 vulnerabilities
Vulnerabilities for packages: renovate, langfuse, code-server, langfuse-fips, kibana, vitess, py3-captum, pelias-api...
GHSA-VMH5-MC38-953G vulnerabilities
Vulnerabilities for packages: renovate, langfuse, code-server, langfuse-fips, kibana, vitess, py3-captum, pelias-api...
GHSA-PR7R-676H-XCF6 vulnerabilities
Vulnerabilities for packages: gemini-cli, renovate, langfuse, code-server, langfuse-fips, kibana, vitess, py3-captum, pelias-api...
CVE-2026-6734 vulnerabilities
Vulnerabilities for packages: renovate, code-server, kibana, vitess, py3-captum, pelias-api...
GHSA-HM92-R4W5-C3MJ vulnerabilities
Vulnerabilities for packages: renovate, code-server, kibana, vitess, py3-captum, pelias-api...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: linkerd2-fips, buildkitd-fips, xeol, k8sgpt, manifest-tool, kargo, k3s, kubescape-operator-fips, steampipe, gitlab-rails-ce, neuvector, docker-cli-buildx-fips, cluster-api-helm-controller-fips, zarf, kubescape-server-fips, harvester-fips, chainctl-fips, headlamp-fips...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: gemini-cli, renovate, actions-runner, code-server, prism, node-gyp, npm, haraka, kibana, saf, vitess, py3-captum, pelias-api...