2026-09-27 归档

今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。

漏洞预警2026-09-26 发布INFO

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "...

CVE-2026-100627

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authentica...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by ...

CVE-2026-100625

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that auth

历史摘要 · 未重新核验 · NVD

#cve #cwe-441

漏洞预警2026-09-26 发布INFO

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an uplo...

CVE-2026-100624

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" a...

CVE-2026-100623

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-26 发布INFO

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download delete...

CVE-2026-100622

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_enc...

CVE-2026-100621

Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-09-26 发布INFO

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI i...

CVE-2026-100620

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onb

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A prin...

CVE-2026-100619

Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores i...

CVE-2026-100618

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions...

CVE-2026-100617

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-26 发布INFO

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organiz...

CVE-2026-100616

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-26 发布INFO

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key...

CVE-2026-100615

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-26 发布INFO

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating...

CVE-2026-100614

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `...

CVE-2026-100613

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current r

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_acti...

CVE-2026-100612

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated us...

CVE-2026-100611

Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may

历史摘要 · 未重新核验 · NVD

#cve #cwe-269

漏洞预警2026-09-26 发布INFO

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspac...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permis

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credenti...

CVE-2026-100609

Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-09-26 发布INFO

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=que...

CVE-2026-100608

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode w

历史摘要 · 未重新核验 · NVD

#cve #cwe-862