PT-2026-99290

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An indirect bypass of the row-level security policy exists in the public.manifest table. A user or principal with app-scoped upload, write, or all API keys, or an authenticated user...

CVE-2026-77239 WACRM: Service-role routes missing a role check

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

PT-2026-95494

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description Account viewers can perform unauthorized actions because flow and automation write routes fail to enforce the agent role before utilizing a service-role database client that bypasses row-level security...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2022-23510

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade ...

CVE-2022-23510: Improper Neutralization of Special Elements used in an SQL Command

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade ...

PT-2017-3860

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 10.x prior to 10.1 PostgreSQL versions 9.6.x prior to 9.6.6 PostgreSQL versions 9.5.x prior to 9.5.10 Description The issue is related to the implementation of the INSERT ... ON CONFLICT DO UPDATE command in PostgreSQL, whi...