Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 498Last 24 hours2,795 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 42 | 38 | 1 | 0 | 83 | 83 |
| Title | ||
|---|---|---|
| CVE-2026-56336 | Capgo - Information Disclosure via Unauthenticated SSO check-domain EndpointCapgo · Capgo | Medium6.9 |
| CVE-2026-56313 | Capgo - Cross-Organization Account Disruption via SSO Prelink EndpointCapgo · Capgo | High7.2 |
| CVE-2026-56308 | Capgo - Insufficient Authentication in Email Change EndpointCapgo · Capgo | High8.4 |
| CVE-2026-56281 | Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats EndpointCapgo · Capgo | Medium5.1 |
| CVE-2026-56252 | Capgo - Scope Isolation Failure in Webhook Test EndpointCapgo · Capgo | Medium5.3 |
| CVE-2026-56241 | Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_rightCapgo · Capgo | High7.2 |
| CVE-2026-56238 | Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointCapgo · Capgo | High8.7 |
| CVE-2026-56303 | Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionCapgo · Capgo | High8.7 |
| CVE-2026-56240 | Capgo - Billing Authorization Bypass via Exhausted Usage CreditsCapgo · Capgo | Medium5.3 |
| CVE-2026-56335 | Capgo - Channel Configuration Mutation via Write-Scoped API KeysCapgo · Capgo | High7.1 |
| CVE-2026-56329 | Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore DecodingCapgo · Capgo | Medium5.3 |
| CVE-2026-56312 | Capgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointCapgo · Capgo | Medium6.9 |
| CVE-2026-56309 | Capgo - Plan Bypass via Unrestricted Attachment Upload EndpointCapgo · Capgo | Medium5.3 |
| CVE-2026-56305 | Capgo - Authentication Bypass in Password Change via Missing Current Password ValidationCapgo · Capgo | High8.7 |
| CVE-2026-56279 | Capgo - Information Disclosure via get_orgs_v7 RPC EndpointCapgo · Capgo | High8.7 |
| CVE-2026-56298 | Capgo - EXIF Metadata Exposure in App Information Image UploadCapgo · Capgo | Medium5.3 |
| CVE-2026-56293 | Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()Capgo · Capgo | Medium5.3 |
| CVE-2026-56283 | Capgo - HTML Injection Leading to Open Redirection in Organization SettingsCapgo · Capgo | Medium4.8 |
| CVE-2026-56250 | Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsCapgo · Capgo | High8.7 |
| CVE-2026-56246 | Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege InheritanceCapgo · Capgo | High7.2 |
| CVE-2026-56220 | Capgo - Unauthorized Manifest Insertion via Read-Only Org MemberCapgo · Capgo | High7.1 |
| CVE-2026-56217 | Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST UpdateCapgo · Capgo | Medium5.3 |
| CVE-2026-56334 | Capgo - Missing UPDATE RLS Policy for Build Status PersistenceCapgo · Capgo | Medium5.3 |
| CVE-2026-56333 | Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesCapgo · Capgo | Medium5.3 |
| CVE-2026-56331 | Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringCapgo · Capgo | Medium6.9 |
| CVE-2026-56328 | Capgo - Integrity Issue in Release Routing via Multiple Public ChannelsCapgo · Capgo | High7.1 |
| CVE-2026-56327 | Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCCapgo · Capgo | Medium6.9 |
| CVE-2026-56320 | Capgo - Org/App Scope Mismatch in Device Creation EndpointCapgo · Capgo | High7.1 |
| CVE-2026-56318 | Capgo - Information Disclosure via /private/validate_password_compliance EndpointCapgo · Capgo | Medium6.9 |
| CVE-2026-56300 | Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCapgo · Capgo | High8.7 |
| CVE-2026-56286 | Capgo - Account Deletion Without Password ConfirmationCapgo · Capgo | High7.0 |
| CVE-2026-56249 | Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionCapgo · Capgo | High7.2 |
| CVE-2026-56247 | Capgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentCapgo · Capgo | High8.7 |
| CVE-2026-56233 | Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyCapgo · Capgo | High8.7 |
| CVE-2026-56230 | Capgo - Broken Object Level Authorization via x-limited-key-id HeaderCapgo · Capgo | High8.7 |
| CVE-2026-56224 | Capgo - Login CSRF and Session Fixation via URL Query ParametersCapgo · Capgo | Medium5.1 |
| CVE-2026-56219 | Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassCapgo · Capgo | High8.7 |
| CVE-2026-56338 | Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCapgo · Capgo | Medium6.9 |
| CVE-2026-56337 | Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2Capgo · Capgo | Medium6.9 |
| CVE-2026-56302 | Capgo - Unsecured Supabase Images Bucket via Missing Row Level SecurityCapgo · Capgo | Medium6.9 |
| CVE-2026-56257 | Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST UpdateCapgo · Capgo | High7.1 |
| CVE-2026-56256 | Capgo - Two-Factor Authentication Bypass via Organization Management APICapgo · Capgo | High7.1 |
| CVE-2026-56244 | Capgo - Webhook Signing Secret Disclosure via Non-Admin API KeyCapgo · Capgo | High7.1 |
| CVE-2026-56237 | Capgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationCapgo · Capgo | Critical9.3 |
| CVE-2026-56232 | Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderCapgo · Capgo | High8.7 |
| CVE-2026-56231 | Capgo - Broken Object Level Authorization in Build Job Control via jobId ParameterCapgo · Capgo | High7.2 |
| CVE-2026-56223 | Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userCapgo · Capgo | Critical9.3 |
| CVE-2026-56322 | Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCapgo · Capgo | High8.7 |
| CVE-2026-56243 | Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneCapgo · Capgo | High8.6 |
| CVE-2026-56234 | Capgo - Password Spraying via Public-Key Accessible Credential Validation EndpointCapgo · Capgo | Medium6.9 |