Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 7.1 CVE-2026-56256

Capgo – Two-Factor Authentication Bypass via Organization Management API_CVE-2026-56256

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g...

Capgo Capgo CVE
HIGH 8.8 CVE-2026-56245

Supabase Capgo – Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC_CVE-2026-56245

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows un...

Cap-go capgo CVE
HIGH 7.1 CVE-2026-56244

Capgo – Webhook Signing Secret Disclosure via Non-Admin API Key_CVE-2026-56244

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies o...

Capgo Capgo CVE
CRITICAL 9.3 CVE-2026-56237

Capgo – Unauthenticated API Key Generation via Client-Side Parameter Manipulation_CVE-2026-56237

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests...

Capgo Capgo CVE
HIGH 8.7 CVE-2026-56232

Capgo – Subkey Scope Bypass in middlewareKey via x-limited-key-id Header_CVE-2026-56232

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewar...

Capgo Capgo CVE
HIGH 7.2 CVE-2026-56231

Capgo – Broken Object Level Authorization in Build Job Control via jobId Parameter_CVE-2026-56231

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:job...

Capgo Capgo CVE
CRITICAL 9.3 CVE-2026-56223

Capgo – Account Takeover via Cross-Domain SSO Email Assertion in provision-user_CVE-2026-56223

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbi...

Capgo Capgo CVE
LOW 1.1 CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org_CVE-2026-13140

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledg...

Thinkst Applied Research Canarytokens sha-4116b92cb CVE
HIGH 7.6 CVE-2025-71354

picklescan – Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText_CVE-2025-71354

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. At...

picklescan picklescan CVE
HIGH 8.5 CVE-2025-71332

Flowise – SQL Injection in importChatflows API via chatflow.id Parameter_CVE-2025-71332

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, a...

Flowise Flowise CVE