SU
Vendor
supabase
5
CVEs
0
On KEV
1
New 30D
Products
RE6.5
realtime
supabase
2 CVEs0 on KEV1 new
AU4.8
auth
supabase
1 CVEs0 on KEV0 new
AU2.7
auth-js
supabase
1 CVEs0 on KEV0 new
PO9.8
Postgres
Supabase
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54238 New | RE realtime supabase | 3.1 | Oct 22 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization |
| CVE-2026-62247 | RE realtime supabase | 6.5 | Sep 21 | Supabase Realtime: Incorrect Authorization |
| CVE-2026-31813 | AU auth supabase | 4.8 | Mar 11 | Supabase Auth has insecure Apple and Azure authentication with ID tokens |
| CVE-2025-48370 | AU auth-js supabase | 2.7 | May 27 | auth-js Vulnerable to Insecure Path Routing from Malformed User Input |
| CVE-2024-24213 | PO Postgres Supabase | 9.8 | Feb 8 | Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query |