PT-2026-51440

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.0 Description The email update functionality fails to invalidate the existing verification state when a user changes their email address. This allows a verified account to retain its verified status after...

PT-2026-51411

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An information disclosure issue exists in the '/functions/v1/channel self' endpoint. Unauthenticated remote attackers can send GET requests using arbitrary app id parameters to enumerate non-public...

MINI-F3M6-Q24V-JVP6

Bulletin has no description...

CVE-2026-10877

creationtimestamp| type| source ---|---|--- 2026-06-21 17:55:41+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116789381354188381...

CVE-2026-56229

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229

Capgo before 12.128.2 has an authorization bypass in /build/status and /build/logs that lets an attacker access build jobs from other apps by mixing app_id and job_id. Limited API keys scoped to one app can read status/logs across apps by using an authorized app_id with a job_id from another app,...

EUVD-2026-38164

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229 Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logs

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

CVE-2026-56229

Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs belonging to different applications by supplying a mismatched appid and jobid combination. Limited API keys restricted to a single app can...

MINI-2Q3P-5HC5-XQ7G

Bulletin has no description...

CVE-2026-12782

creationtimestamp| type| source ---|---|--- 2026-06-21 10:32:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116787630904398394 2026-06-22 01:39:40+00:00| seen| https://www.acn.gov.it/portale/w/easeus-poc-pubblici-per-il-prodotto-partition-master...

PT-2026-51218

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An authorization bypass exists in the '/build/status' and '/build/logs' endpoints. Attackers can access build jobs belonging to different applications by providing a mismatched app id and job id...

CVE-2026-56304

creationtimestamp| type| source ---|---|--- 2026-06-20 20:19:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqok5jmtt2f...

CVE-2026-51846

creationtimestamp| type| source ---|---|--- 2026-06-20 16:10:14+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116783304621209682...

CVE-2019-25763

creationtimestamp| type| source ---|---|--- 2026-06-20 15:59:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moq7z4l7zk2b...

CVE-2026-56267 Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs,...

GHSA-4XGF-CPJX-PC3J

creationtimestamp| type| source ---|---|--- 2026-06-20 14:29:23+00:00| seen| https://gist.github.com/konard/4b48b247d88d1fe3f1e7f6cd34987449...

SUSE CVE-2026-54274

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1...

CVE-2026-56214

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints istrialorg and ispayingorg that allows unauthenticated attackers to enumerate organizations and disclose billing status using the public sbpublishable key. Attackers can invoke these endpoin...