supabase has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 4.8 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
supabase vulnerabilities
CVEs affecting supabase, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-54238Low· 3.1Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an expired JWT when the exp claim is encoded as a JSON string instead of a JSON number. Th…
▾ Sunlitsupabase · realtimeEPSS 0.21%via CVEORG
CVE-2026-62247Medium· 6.5Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets
Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel clien…
▾ Sunlitsupabase · realtimeEPSS 0.45%via NVD