#cyber-security — Public Fediverse posts

RE: https://infosec.exchange/@betweenthehacks/116885082512333574

I recently encountered a ClickFix attack while visiting a trusted website. After reproducing it across multiple browsers, I realized the larger story isn’t just the malware, it’s how attackers are increasingly impersonating security mechanisms themselves.

I wrote about the experience and what it means for users and organizations.

https://betweenthehacks.com/blog/clickfix

#Cybersecurity #ClickFix #SocialEngineering

A CAPTCHA should never ask you to open Terminal.

I recently encountered a real ClickFix attack while visiting a trusted website. That experience led me to investigate why attackers are increasingly impersonating security itself instead of simply impersonating trusted brands.

New Between The Hacks article:

https://betweenthehacks.com/blog/clickfix

#ClickFix #Cybersecurity #InfoSec #SocialEngineering

Hacktivists call out #Trump by hacking and defacing US #Army websites

https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/

#cybersecurity #politics #military

Hacktivists call out #Trump by hacking and defacing US #Army websites

https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/

#cybersecurity #politics #military

Alien conspiracies on the web #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime https://negativepid.blog/alien-conspiracies-on-the-web/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Negative-PID-Blog

Alien conspiracies on the web #negativepid #digitalInvestigations #OSINT #cybersecurity #AI #tech #onlineInvestigations #robotics #cyberpsychology #cybercrime https://negativepid.blog/alien-conspiracies-on-the-web/?utm_source=mastodon&utm_medium=social&utm_campaign=fedica-Negative-PID-Blog

AI is reshaping both sides of Canada’s immigration fraud battle
#Canada #Ontario #Immigration #ImmigrationFraud #AI #IRCC #CyberSecurity #DigitalIdentity #ImmigrationLaw #Tech #CanadaImmigration #ScamAlert #FraudPrevention #PublicSafety #ImmigrationNews
https://the-14.com/ai-is-reshaping-both-sides-of-canadas-immigration-fraud-battle/

AI is reshaping both sides of Canada’s immigration fraud battle
#Canada #Ontario #Immigration #ImmigrationFraud #AI #IRCC #CyberSecurity #DigitalIdentity #ImmigrationLaw #Tech #CanadaImmigration #ScamAlert #FraudPrevention #PublicSafety #ImmigrationNews
https://the-14.com/ai-is-reshaping-both-sides-of-canadas-immigration-fraud-battle/

We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.

https://pivotick.github.io/Pivotick/

https://github.com/Pivotick/Pivotick

#infovis #cybersecurity #opensource

We are exploring some ambitious ideas around reducing external dependencies and relying more on our own libraries across MISP and related tooling. Over the past year, we have been working on a replacement network graph library for the new MISP interface and things are getting really interesting. Pivotick is already used in around ten open-source tools, including CTI Transmute, AIL Project, and Rulezet. It has also recently been integrated into the new MISP UI, OverMind. The library is, of course, open source and comes with extensive documentation, including AI-parseable documentation to make integration easier. We have just released Pivotick v1.2.0.

https://pivotick.github.io/Pivotick/

https://github.com/Pivotick/Pivotick

#infovis #cybersecurity #opensource

🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.

The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.

Listen/Read: https://hackread.com/armored-likho-government-energy-busysnake-stealer/

#CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage

🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.

The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.

Listen/Read: https://hackread.com/armored-likho-government-energy-busysnake-stealer/

#CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage

🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ State IDs for AI Agents: Will Estonia Set a Precedent?
🔗 https://www.darkreading.com/cybersecurity-operations/state-ids-ai-agents-estonia

The world's digital testing ground plans to help people use AI agents for government purposes.

🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ State IDs for AI Agents: Will Estonia Set a Precedent?
🔗 https://www.darkreading.com/cybersecurity-operations/state-ids-ai-agents-estonia

The world's digital testing ground plans to help people use AI agents for government purposes.

Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen

Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/accenture-confirms-security-breach-after-hacker-claims-35-gb-of-data-was-stolen-r-t-b-2-4/gD2P6Ple2L

Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen

Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/accenture-confirms-security-breach-after-hacker-claims-35-gb-of-data-was-stolen-r-t-b-2-4/gD2P6Ple2L

🚨 EUVD-2026-42234

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
🏢 Vendor: christopherthielen
📅 Updated: 2026-07-08

📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42234

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42236

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42236

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42234

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
🏢 Vendor: christopherthielen
📅 Updated: 2026-07-08

📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42234

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42236

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42236

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42235

📊 Score: 9.1/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08

📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42235

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42235

📊 Score: 9.1/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08

📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42235

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42238

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
🏢 Vendor: flask-dashboard
📅 Updated: 2026-07-08

📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42238

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42237

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08

📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42237

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42237

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08

📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42237

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42238

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
🏢 Vendor: flask-dashboard
📅 Updated: 2026-07-08

📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42238

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42239

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08

📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42239

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42239

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08

📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42239

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42240

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42240

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42241

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08

📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42241

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42240

📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42240

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42241

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08

📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42241

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42242

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Omnissa Workspace ONE® Tunnel for Windows
🏢 Vendor: Omnissa
📅 Updated: 2026-07-08

📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42242

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42242

📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Omnissa Workspace ONE® Tunnel for Windows
🏢 Vendor: Omnissa
📅 Updated: 2026-07-08

📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42242

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42243

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42243

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42243

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42243

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42233

📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: Blocksy Companion, Blocksy Companion
🏢 Vendor: Creative Themes
📅 Updated: 2026-07-08

📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42233

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42244

📊 Score: 2.7/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42244

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42244

📊 Score: 2.7/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08

📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42244

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42233

📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: Blocksy Companion, Blocksy Companion
🏢 Vendor: Creative Themes
📅 Updated: 2026-07-08

📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42233

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42245

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Tanium Server, Tanium Server, Tanium Server
🏢 Vendor: Tanium
📅 Updated: 2026-07-08

📝 Tanium addressed a denial of service vulnerability in Tanium Server.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42245

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42245

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Tanium Server, Tanium Server, Tanium Server
🏢 Vendor: Tanium
📅 Updated: 2026-07-08

📝 Tanium addressed a denial of service vulnerability in Tanium Server.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42245

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42246

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08

📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42246

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42246

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08

📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42246

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42247

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08

📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42247

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42247

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08

📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42247

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42248

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08

📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42248

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42248

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08

📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42248

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42250

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08

📝 Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controll...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42250

#cybersecurity #infosec #euvd #cve #vulnerability