Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 5.6 CVE-2026-56272

Flowise – Insufficient Password Salt Rounds in Bcrypt Hashing_CVE-2026-56272

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds...

Flowise Flowise CVE
HIGH 8.7 CVE-2026-56270

Flowise – Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint_CVE-2026-56270

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows ...

Flowise Flowise CVE
MEDIUM 4.3 CVE-2026-56269

Flowise – Weak Default Token Hash Secret in JWT Token Encryption_CVE-2026-56269

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' for the TOKEN_HASH_SECRET env...

Flowise Flowise CVE
MEDIUM 6.9 CVE-2026-56262

Crawl4AI – Unauthenticated Access to Monitor Endpoints via Docker API Server_CVE-2026-56262

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to acce...

Crawl4AI Crawl4AI CVE
HIGH 7.1 CVE-2026-56257

Capgo – Authorization Bypass in App Ownership Transfer via Direct PostgREST Update_CVE-2026-56257

Capgo before 12.128.2 allows direct patching of public.apps.owner_org through PostgREST, bypassing the transfer_app() workflow and creating split-b...

Capgo Capgo CVE
HIGH 7.1 CVE-2026-56256

Capgo – Two-Factor Authentication Bypass via Organization Management API_CVE-2026-56256

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g...

Capgo Capgo CVE
HIGH 8.8 CVE-2026-56245

Supabase Capgo – Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC_CVE-2026-56245

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows un...

Cap-go capgo CVE
HIGH 7.1 CVE-2026-56244

Capgo – Webhook Signing Secret Disclosure via Non-Admin API Key_CVE-2026-56244

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies o...

Capgo Capgo CVE
CRITICAL 9.3 CVE-2026-56237

Capgo – Unauthenticated API Key Generation via Client-Side Parameter Manipulation_CVE-2026-56237

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests...

Capgo Capgo CVE
HIGH 8.7 CVE-2026-56232

Capgo – Subkey Scope Bypass in middlewareKey via x-limited-key-id Header_CVE-2026-56232

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewar...

Capgo Capgo CVE