Skip to contentCap-go vulnerabilities
Newest
- cap-go capgoCapgo - Missing UPDATE RLS Policy for Build Status PersistenceCVE-2026-563345.3 Medium
- cap-go capgoCapgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesCVE-2026-563335.3 Medium
- cap-go capgoCapgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringCVE-2026-563316.9 Medium
- cap-go capgoCapgo - Integrity Issue in Release Routing via Multiple Public ChannelsCVE-2026-563287.1 High
- cap-go capgoCapgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCCVE-2026-563276.9 Medium
- cap-go capgoCapgo - Org/App Scope Mismatch in Device Creation EndpointCVE-2026-563207.1 High
- cap-go capgoCapgo - Information Disclosure via /private/validate_password_compliance EndpointCVE-2026-563186.9 Medium
- cap-go capgoCapgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCVE-2026-563008.7 High
- cap-go capgoCapgo - Account Deletion Without Password ConfirmationCVE-2026-562867.0 High
- cap-go capgoCapgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionCVE-2026-562497.2 High
- cap-go capgoCapgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentCVE-2026-562478.7 High
- cap-go capgoCapgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyCVE-2026-562338.7 High
- cap-go capgoCapgo - Broken Object Level Authorization via x-limited-key-id HeaderCVE-2026-562308.7 High
- cap-go capgoCapgo - Login CSRF and Session Fixation via URL Query ParametersCVE-2026-562245.1 Medium
- cap-go capgoCapgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassCVE-2026-562198.7 High
- cap-go capgoCapgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCVE-2026-563386.9 Medium
- cap-go capgoCapgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2CVE-2026-563376.9 Medium
- cap-go capgoCap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope BypassCVE-2026-563105.3 Medium
- cap-go capgoCapgo - Unsecured Supabase Images Bucket via Missing Row Level SecurityCVE-2026-563026.9 Medium
- cap-go capgoCapgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST UpdateCVE-2026-562577.1 High
- cap-go capgoCapgo - Two-Factor Authentication Bypass via Organization Management APICVE-2026-562567.1 High
- cap-go capgoSupabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPCCVE-2026-562458.8 High
- cap-go capgoCapgo - Webhook Signing Secret Disclosure via Non-Admin API KeyCVE-2026-562447.1 High
- cap-go capgoCapgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationCVE-2026-562379.3 Critical
- cap-go capgoCapgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderCVE-2026-562328.7 High
- cap-go capgoCapgo - Broken Object Level Authorization in Build Job Control via jobId ParameterCVE-2026-562317.2 High
- cap-go capgoCapgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userCVE-2026-562239.3 Critical
- cap-go capgoCapgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCVE-2026-563228.7 High
- cap-go capgoCapgo - Unauthenticated Denial-of-Service via audit_logs RLS PolicyCVE-2026-562488.7 High
- cap-go capgoCapgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlaneCVE-2026-562438.6 High
- cap-go capgoCapgo - Password Spraying via Public-Key Accessible Credential Validation EndpointCVE-2026-562346.9 Medium
- cap-go capgoCapgo - Authorization Bypass in API Key Management via App-Limited KeysCVE-2026-562258.7 High
- cap-go capgoCapgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsCVE-2026-562228.6 High
- cap-go capgoCapgo - Rate Limit Bypass via User-Controlled device_id ParameterCVE-2026-563248.8 High
- cap-go capgoCapgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfCVE-2026-563238.7 High
- cap-go capgoCapgo - Missing Authentication Middleware on GET /private/role_bindings EndpointCVE-2026-563216.9 Medium
- cap-go capgoCapgo - Deleted Bundle Selection via Missing Deletion Filter in /updates EndpointCVE-2026-563147.1 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPCCVE-2026-563116.9 Medium
- cap-go capgoCapgo - Subkey Enforcement Bypass via x-limited-key-id Header ParsingCVE-2026-563065.3 Medium
- cap-go capgoCap-go - Privilege Inversion in Build Log Stream via SSE DisconnectCVE-2026-562807.1 High
- cap-go capgoCapgo - Denial of Service via Unlimited Demo App CreationCVE-2026-562555.3 Medium
- cap-go capgoCap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.tsCVE-2026-562217.1 High
- cap-go capgoCap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*CVE-2026-563166.9 Medium
- cap-go capgoCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointCVE-2026-562996.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPCCVE-2026-562538.7 High
- cap-go capgoCapgo - Privilege Escalation via Broken Row Level Security in org_usersCVE-2026-562517.0 High
- cap-go capgoCapgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCVE-2026-562428.7 High
- cap-go capgoCapgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overageCVE-2026-562397.2 High
- cap-go capgoCapgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/status and /build/logsCVE-2026-562297.1 High
- cap-go capgoCapgo - Open Redirect via confirmation_url ParameterCVE-2026-563325.1 Medium
- Show moreLoading…