https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T10:24:46.976677+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328834 EUVD-2026-328834 2026-10-10T10:24:47.022710+00:00 EUVD-2026-328834 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56242 fkie_cve-2026-56242 2026-10-10T10:24:47.022747+00:00

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.

 https://cve.radiocsirt.org/vuln/ghsa-wc33-3x6m-7v3x GHSA-wc33-3x6m-7v3x 2026-10-10T10:24:47.022781+00:00

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs like get_orgs_v6 to retrieve organization membership and management email PII.