Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.9 CVE-2026-56262

Crawl4AI – Unauthenticated Access to Monitor Endpoints via Docker API Server_CVE-2026-56262

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to acce...

Crawl4AI Crawl4AI CVE
HIGH 7.1 CVE-2026-56257

Capgo – Authorization Bypass in App Ownership Transfer via Direct PostgREST Update_CVE-2026-56257

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-b...

Capgo Capgo CVE
HIGH 7.1 CVE-2026-56256

Capgo – Two-Factor Authentication Bypass via Organization Management API_CVE-2026-56256

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g...

Capgo Capgo CVE
HIGH 8.8 CVE-2026-56245

Supabase Capgo – Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC_CVE-2026-56245

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows un...

Cap-go capgo CVE
HIGH 7.1 CVE-2026-56244

Capgo – Webhook Signing Secret Disclosure via Non-Admin API Key_CVE-2026-56244

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies o...

Capgo Capgo CVE
CRITICAL 9.3 CVE-2026-56237

Capgo – Unauthenticated API Key Generation via Client-Side Parameter Manipulation_CVE-2026-56237

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests...

Capgo Capgo CVE
HIGH 8.7 CVE-2026-56232

Capgo – Subkey Scope Bypass in middlewareKey via x-limited-key-id Header_CVE-2026-56232

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewar...

Capgo Capgo CVE
HIGH 7.2 CVE-2026-56231

Capgo – Broken Object Level Authorization in Build Job Control via jobId Parameter_CVE-2026-56231

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:job...

Capgo Capgo CVE
CRITICAL 9.3 CVE-2026-56223

Capgo – Account Takeover via Cross-Domain SSO Email Assertion in provision-user_CVE-2026-56223

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbi...

Capgo Capgo CVE
LOW 1.1 CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org_CVE-2026-13140

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledg...

Thinkst Applied Research Canarytokens sha-4116b92cb CVE