Supabase

CVE-2025-48757 is a critical Row Level Security (RLS) vulnerability in the Lovable-Supabase integration that exposed over 170 production applications to unauthenticated data access. The flaw resulted from misconfigured or unconfigured RLS policies, allowing attackers to perform unauthenticated data dumps from affected applications.

• Critical Row Level Security (RLS) Vulnerability (CVE-2025-48757)(opens in a new tab)

CVE-2026-19333 is a medium-severity command injection vulnerability in NightTrek Supabase-MCP affecting the generate_types component. The flaw allows attackers with local access and low privileges to execute arbitrary commands via manipulation of the schema argument. As of publication (08/09/2026), the vendor has not issued a response or patch.

• CVE-2026-19333: Command Injection in NightTrek Supabase-MCP - Li(opens in a new tab)