CA
Product
capgo
17
CVEs
0
On KEV
9.4
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 9Low 0
Watch
Add capgo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56073 | 9.4 | Jun 19 | Cap-go - OTP Bypass via Response Manipulation in Email Verification Affected: before 12.128.2 |
| CVE-2026-56081 | 9.1 | Jun 19 | Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email Affected: before 12.128.2 |
| CVE-2026-56245 | 8.2 | Jun 24 | Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC Affected: before 12.128.2 |
| CVE-2026-56339 | 7.5 | Jul 15 | Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC Affected: before 12.128.2 |
| CVE-2026-56226 | 7.5 | Jul 8 | Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC Affected: before 12.128.2 |
| CVE-2026-56248 | 7.5 | Jun 23 | Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy Affected: before 12.128.12 |
| CVE-2026-56082 | 7.5 | Jun 19 | Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC Affected: before 12.128.2 |
| CVE-2026-56280 | 7.1 | Jun 22 | Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect Affected: before 12.128.2 |
| CVE-2026-56221 | 6.5 | Jun 22 | Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts Affected: before 12.128.2 |
| CVE-2026-53982 | 6.5 | Jun 12 | Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association Affected: before 12.28.2 |
| CVE-2026-56296 | 5.3 | Jul 11 | Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC Affected: before 12.128.2 |
| CVE-2026-56284 | 5.3 | Jul 8 | Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC Affected: before 12.128.2 |
| CVE-2026-56316 | 5.3 | Jun 21 | Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/* Affected: before 12.128.2 |
| CVE-2026-56235 | 5.3 | Jun 20 | Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions Affected: before 12.128.2 |
| CVE-2026-56080 | 4.9 | Jun 19 | Cap-go - Authentication Logic Flaw in Enforce Password Policy Affected: before 12.128.2 |
| CVE-2026-56310 | 4.3 | Jun 24 | Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass Affected: before 12.128.2 |
| CVE-2026-56307 | 4.3 | Jun 20 | Cap-go - Broken Cursor Pagination in /private/devices Endpoint Affected: before 12.128.12 |
Showing 17