supahunter

Supabase Hunter OP Mode Advanced Reconnaissance & Exploitation Tool for Supabase Instances. SupaHunter is a powerful Python tool designed to identify, analyze, and exploit misconfigured Supabase projects. It goes beyond simple table enumeration, offering deep inspection capabilities, Selenium-bas...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

vibe-coding-security

Vibe Coding Security Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE CVE-2025-48757, 170+ apps, 2025, the Moltbook leak 1.5M API tokens, Feb 2026, and the April 2026 Lovable platform breach source code + service keys of other users'...

EUVD-2026-87713

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

Supabase Realtime Channel Abuse

Joins Supabase Realtime Phoenix channels for PostgREST tables using a leaked anon or servicerole key — tests RLS bypass on live subscriptions. !/usr/bin/env python3 -- coding: utf-8 -- """ Abuse Supabase Realtime channels using leaked anon/servicerole JWT keys. Follow-up for...

CVE-2026-56334

Capgo before 12.128.2 is affected by an insufficient UPDATE row-level security (RLS) policy on the build_requests table. The missing policy allows API-key and anonymous access to persist builder status updates to be blocked or unpersisted, resulting in build status and error details remaining in ...

CVE-2026-56248

Cap-go capgo capgo-backend before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the auditlogs table's Row-Level Security RLS policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection,...

CVE-2026-56243

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...

EUVD-2026-38430

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...

CVE-2026-56243 Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...

CVE-2026-56243: Authentication Bypass Using an Alternate Path or Channel

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...

auditize (>=0.2.1, <=0.2.4), otto-m8-backend (>=0.0.3, <=0.0.4) +3 more potentially affected by CVE-2026-54282 via starlette (0.38.5)

starlette PYPI version 0.38.5 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditize =0.2.1, =0.0.3, =0.0.0, =0.1.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

CVE-2026-56251

Capgo before 12.128.2 contains a broken row level security policy in the orgusers table that allows authenticated users to elevate privileges from admin to superadmin. Attackers can exploit the insufficient RLS enforcement to gain unauthorized superadmin access and compromise system security...

auditize (>=0.2.1, <=0.2.4), otto-m8-backend (>=0.0.3, <=0.0.4) +3 more potentially affected by CVE-2026-48818 via starlette (0.38.5)

starlette PYPI version 0.38.5 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditize =0.2.1, =0.0.3, =0.0.0, =0.1.0 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

auditize (>=0.2.1, <=0.2.4), otto-m8-backend (>=0.0.3, <=0.0.4) +3 more potentially affected by CVE-2026-48817 via starlette (0.38.5)

starlette PYPI version 0.38.5 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditize =0.2.1, =0.0.3, =0.0.0, =0.1.0 Source cves: CVE-2026-48817 Source advisory: OSV:GHSA-X746-7M8F-X49C...

CVE-2026-7183

A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rlspdu.cpp of the component Radio Link Simulation Layer. The manipulation of the argument pduLength leads to uncaught exception. The attack may be...

auditize (>=0.2.1, <=0.2.4), otto-m8-backend (>=0.0.3, <=0.0.4) +3 more potentially affected by CVE-2026-48710 via starlette (0.38.5)

starlette PYPI version 0.38.5 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditize =0.2.1, =0.0.3, =0.0.0, =0.1.0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...