Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API k...

CVE-2026-56242

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns th

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated ...

CVE-2026-56282

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that

历史摘要 · 未重新核验 · GitHub Advisory

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC...

CVE-2026-56235

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metri

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded...

CVE-2026-56218

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing informa

历史摘要 · 未重新核验 · GitHub Advisory

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account...

CVE-2026-56267

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoin

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replication telemetry includ...

CVE-2026-56282

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that

历史摘要 · 未重新核验 · NVD

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthe...

CVE-2026-56267

Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoin

历史摘要 · 未重新核验 · NVD

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are grant...

CVE-2026-56235

Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metri

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images a...

CVE-2026-56218

Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing informa

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC...

CVE-2026-56214

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and is_paying_org that allows unauthenticated attackers t...

CVE-2026-56214

CVE-2026-56214 是 Capgo 产品（版本 12.128.2 之前）中存在的一个信息泄露漏洞，该漏洞位于 Supabase PostgREST RPC 端点 is_trial_org 和 is_paying_org 中。由于这

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST...

CVE-2026-56079

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook sec...

CVE-2026-56079

CVE-2026-56079 是 Capgo 平台（版本低于 12.128.2）中存在的一个跨租户授权绕过漏洞。该漏洞位于 PostgREST 端点，允许拥有组织作用域读取权限的 API 密钥访问其他租户的 webhook 密钥和投递日志。

历史摘要 · 未重新核验 · NVD

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel

历史摘要 · 未重新核验 · GitHub Advisory

parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change

### Impact A Parse Server LiveQuery subscriber can receive object field values they are not authorized to read when a s

历史摘要 · 未重新核验 · GitHub Advisory

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

CVE-2026-55447

### Summary All components based on `BaseFileComponent` are vulnerable to the following vulnerability: 1. Docling (`Docl

历史摘要 · 未重新核验 · GitHub Advisory

http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default

### Impact The previous `BasicCookieStorage` did not enforce RFC 6265 scoping rules around cookie domain, path, and `Se

历史摘要 · 未重新核验 · GitHub Advisory

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

CVE-2026-55837

## Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens ### Summary The local OAuth helper FastAPI server

历史摘要 · 未重新核验 · GitHub Advisory

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

CVE-2026-11769

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path

历史摘要 · 未重新核验 · GitHub Advisory

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@microsoft/kiota-http-...

CVE-2026-49336

@microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-prev

历史摘要 · 未重新核验 · NVD