Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,160All CVEsplus 19,120 rejected
- 490Last 24 hours2,790 in the last 7 days
- 16,892Last 30 days1,556 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 26 | 12 | 0 | 0 | 42 | 42 |
| Title | ||
|---|---|---|
| CVE-2026-100626 | capgo through 12.128.2 IDOR via PUT /app icon endpointCap-go · capgo.app | Medium5.3 |
| CVE-2026-100629 | Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCHCap-go · capgo.app | High7.0 |
| CVE-2026-100628 | capgo.app before 12.128.12 Authentication Bypass via apikeyCap-go · capgo.app | High8.7 |
| CVE-2026-100627 | Capgo bundle promotion API channel RBAC deny override bypassCap-go · capgo.app | High7.2 |
| CVE-2026-100625 | Capgo Build Upload Proxy Authorization Bypass via TUS ResourceCap-go · capgo.app | High8.7 |
| CVE-2026-100624 | Capgo.app before 12.264.5 Upload Expiry Bypass via build uploadCap-go · capgo.app | Medium5.3 |
| CVE-2026-100623 | Capgo Authentication Bypass via Direct PostgREST org_users Table WriteCap-go · capgo.app | High8.7 |
| CVE-2026-100622 | capgo.app through 12.129.0 Cache Restoration of Deleted BundlesCap-go · capgo.app | High8.7 |
| CVE-2026-100621 | capgo.app Content-Lock Bypass via r2-direct Bundle MutationCap-go · capgo.app | Medium5.3 |
| CVE-2026-100620 | Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service AccountCap-go · @capgo/cli | Medium5.1 |
| CVE-2026-100619 | Capgo OTA Manifest Poisoning via app_versions.manifest BypassCap-go · capgo.app | High8.7 |
| CVE-2026-100618 | Capgo App Icon Update Privilege Escalation via Service-Role WorkerCap-go · capgo.app | High8.7 |
| CVE-2026-100617 | Cap-go capgo.app Authorization Bypass via channel_permission_overridesCap-go · capgo.app | High8.7 |
| CVE-2026-100616 | capgo.app Authentication Bypass via PostgREST customer_id MutationCap-go · capgo.app | High7.0 |
| CVE-2026-100615 | Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key RotationCap-go · capgo.app | High8.7 |
| CVE-2026-100614 | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata WorkerCap-go · capgo.app | High8.7 |
| CVE-2026-100613 | capgo.app Authorization Bypass via Stale Channel Permission OverridesCap-go · capgo.app | Medium6.0 |
| CVE-2026-100612 | Capgo SSO Provider ID Authentication Bypass via Incomplete MigrationCap-go · capgo.app | High8.6 |
| CVE-2026-100611 | Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-listCap-go · capgo.app | High7.1 |
| CVE-2026-88864 | Capgo SSO Provider Authentication Bypass via PostgREST Direct WriteCap-go · capgo.app | Critical9.3 |
| CVE-2026-88863 | capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_orgCap-go · capgo.app | High8.6 |
| CVE-2026-88862 | Capgo API Key Manager Authentication Bypass via x-limited-key-idCap-go · capgo.app | High8.7 |
| CVE-2026-88861 | Capgo AAL1 Session MFA Bypass via Direct RBAC AuthorizationCap-go · capgo.app | High8.7 |
| CVE-2026-88860 | Capgo Authorization Bypass via Stale Channel Permission OverridesCap-go · capgo.app | Critical9.3 |
| CVE-2026-56339 | Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCCap-go · capgo | High8.7 |
| CVE-2026-56296 | Cap-go - App Existence Oracle via Unauthenticated transfer_app RPCCap-go · capgo | Medium6.9 |
| CVE-2026-56284 | Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPCCap-go · capgo | Medium6.9 |
| CVE-2026-56226 | Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPCCap-go · capgo | High8.7 |
| CVE-2026-56310 | Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope BypassCap-go · capgo | Medium5.3 |
| CVE-2026-56245 | Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPCCap-go · capgo | High8.8 |
| CVE-2026-56248 | Capgo - Unauthenticated Denial-of-Service via audit_logs RLS PolicyCap-go · capgo | High8.7 |
| CVE-2026-56280 | Cap-go - Privilege Inversion in Build Log Stream via SSE DisconnectCap-go · capgo | High7.1 |
| CVE-2026-56221 | Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.tsCap-go · capgo | High7.1 |
| CVE-2026-56316 | Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*Cap-go · capgo | Medium6.9 |
| CVE-2026-56307 | Cap-go - Broken Cursor Pagination in /private/devices EndpointCap-go · capgo | Medium5.3 |
| CVE-2026-56235 | Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC FunctionsCap-go · capgo | Medium6.9 |
| CVE-2026-56082 | Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPCCap-go · capgo | High8.7 |
| CVE-2026-56081 | Cap-go - Account Lockout via 2FA Misconfiguration on Unverified EmailCap-go · capgo | Critical9.3 |
| CVE-2026-56080 | Cap-go - Authentication Logic Flaw in Enforce Password PolicyCap-go · capgo | Medium6.9 |
| CVE-2026-56073 | Cap-go - OTP Bypass via Response Manipulation in Email VerificationCap-go · capgo | Critical9.3 |
| CVE-2026-53982 | Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier AssociationCap-go · capgo | High7.1 |
| CVE-2026-53981 | Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change MechanismCap-go · Cap-go | High7.2 |