60243 matches found
CVE-2026-56248
Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...
CVE-2026-56243 Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...
EUVD-2026-38430
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...
CVE-2026-56243
Capgo before 12.128.2 has a security control bypass in the PostgREST/RLS plane: it accepts plaintext API keys via the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext keys directly to the PostgREST/RLS plane t...
CVE-2026-56225
Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...
CVE-2026-56225 Capgo - Authorization Bypass in API Key Management via App-Limited Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Background Fetch API in Google Chrome prior to 144.0.7559.110 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Using the “after free” mechanism in the Digital Credentials API in Google Chrome before version 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
CVE-2026-9678 vulnerabilities
Vulnerabilities for packages: langfuse-fips, kibana, code-server, gemini-cli, langfuse, renovate, py3-captum, pelias-api, vitess...
GHSA-VMH5-MC38-953G vulnerabilities
Vulnerabilities for packages: langfuse-fips, kibana, code-server, renovate, langfuse, py3-captum, pelias-api, vitess...
CVE-2026-9697 vulnerabilities
Vulnerabilities for packages: langfuse-fips, kibana, code-server, renovate, langfuse, py3-captum, pelias-api, vitess...
GHSA-HM92-R4W5-C3MJ vulnerabilities
Vulnerabilities for packages: kibana, code-server, renovate, py3-captum, pelias-api, vitess...
GHSA-PR7R-676H-XCF6 vulnerabilities
Vulnerabilities for packages: langfuse-fips, kibana, code-server, gemini-cli, langfuse, renovate, py3-captum, pelias-api, vitess...
CVE-2026-6734 vulnerabilities
Vulnerabilities for packages: kibana, code-server, renovate, py3-captum, pelias-api, vitess...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: cloudbeat, docker-cli-buildx-fips, cloudbeat-fips, xeol-fips, kubescape-server, helm-fips, redpanda-operator, kubescape-operator-fips, consul-k8s-fips, jfrog-cli, grype-db, zot, chartmuseum, helm-operator, helmfile, linkerd2, steampipe, trivy, kube-mgmt,...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: kibana, code-server, npm, node-gyp, saf, gemini-cli, prism, renovate, py3-captum, actions-runner, haraka, pelias-api, vitess...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: kibana, code-server, npm, node-gyp, saf, gemini-cli, prism, renovate, py3-captum, actions-runner, haraka, pelias-api, vitess...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: kibana, code-server, npm, node-gyp, saf, gemini-cli, prism, renovate, py3-captum, actions-runner, haraka, pelias-api, vitess...