CVE-2026-56238 Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST globalstats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/globalstats endpoin...

EUVD-2026-43223

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST globalstats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/globalstats endpoin...

CVE-2026-56238 Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST globalstats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/globalstats endpoin...

PT-2026-57547

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global stats...

Security Bulletin: IBM Operational Decision Manager for May 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take contr...

The vulnerability of the FLS module in the OpenSearch software package allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the FLS module in the OpenSearch software package is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the FinOps tool for analysis, forecasting, budget limiting, and resource cost optimization in Microsoft Cost Management lies in the insufficient protection of operational data, allowing attackers to exploit this weakness to disclose protected information.

The vulnerability of the FinOps tool for analysis, forecasting, budget limiting, and resource cost optimization in Microsoft Cost Management is related to insufficient protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

The vulnerability of the Splunk Enterprise platform for operational analysis, related to access control errors, allows attackers to compromise the integrity of protected information.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to access control errors, which allow attackers to compromise the integrity of the protected information...

The vulnerability of the Splunk Enterprise platform for operational analysis allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Splunk Enterprise platform for operational analysis is related to improper handling of data with Unicode encoding. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Top Cyber Range Providers: A Comparison of 15 Leading Platforms

Compare 15 cyber range platforms across live-fire exercises, AI testing, SOC training, OT realism, deployment options, pricing models, and data residency needs...

Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems

Novel safety, socio-economic, and ethical harms arising from the deployment of AI-based systems have led to a breadth of work seeking to map, measure, and mitigate against newly found risks. These works have heavily leveraged techniques and terminology from the fields of System Safety Engineering...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, zarf-fips, kubescape, glab, crossplane-provider-aws-scheduler, crossplane-provider-aws-cloudfront-fips, apko, slsa-verifier, kyverno-policy-reporter-plugins-kyverno, traefik, crossplane-provider-aws-kendra-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, zarf-fips, kubescape, glab, crossplane-provider-aws-scheduler, crossplane-provider-aws-cloudfront-fips, apko, slsa-verifier, kyverno-policy-reporter-plugins-kyverno, traefik, crossplane-provider-aws-kendra-fips,...

GTI-MSEMP Framework : A Proposed Framework to Stimulate Malware Propagation with Inclusion of Attacker-Defender Strategy

The rapid proliferation of automated, multi-vector malware threats poses a significant risk to heterogeneous, resource constrained cyber-physical networks. Conventional epidemiological models often treat security defenses as static parameters, failing to capture the strategic, asymmetric maneuver...

CVE-2026-55838: Missing Authorization

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validateadminrequest to...

Beyond IOCs: AI-enabled threat intelligence

Welcome to this week's Threat Source newsletter. The issue of AI in cybersecurity is often portrayed as a binary choice: either a force multiplier for our adversaries, or a tool bringing professional obsolescence. The reality is more nuanced. While AI certainly brings some advantage to attackers,...

CVE-2026-53257

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: enforce HE/EHT cap/oper consistency Xiang Mei reports that mac80211 could crash if ehtcap is set but ehtoper isn't. Rather than fixing that for the individual users, enforce that both HE/EHT have consistent elemen...

The vulnerability of the Web Services component of the Oracle WebLogic Server application server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web Services component of the Oracle WebLogic Server application server is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through HTTP...

Siemens RUGGEDCOM RST2428P Stack-based Buffer Overflow (CVE-2025-6170)

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...

Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms. Yet despite this abundance of information, many organizations...