CA
Vendor
Cap-go
42
CVEs
0
On KEV
0
New 30D
Products
CA9.1
capgo.app
Cap-go
23 CVEs0 on KEV0 new
CA9.4
capgo
Cap-go
17 CVEs0 on KEV0 new
CA7.6
Cap-go
Cap-go
1 CVEs0 on KEV0 new
CA3.8
@capgo/cli
Cap-go
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100626 | CA capgo.app Cap-go | 4.3 | Sep 26 | capgo through 12.128.2 IDOR via PUT /app icon endpoint |
| CVE-2026-100629 | CA capgo.app Cap-go | 5.5 | Sep 26 | Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH |
| CVE-2026-100628 | CA capgo.app Cap-go | 4.3 | Sep 26 | capgo.app before 12.128.12 Authentication Bypass via apikey |
| CVE-2026-100627 | CA capgo.app Cap-go | 8.1 | Sep 26 | Capgo bundle promotion API channel RBAC deny override bypass |
| CVE-2026-100625 | CA capgo.app Cap-go | 7.1 | Sep 26 | Capgo Build Upload Proxy Authorization Bypass via TUS Resource |
| CVE-2026-100624 | CA capgo.app Cap-go | 5.4 | Sep 26 | Capgo.app before 12.264.5 Upload Expiry Bypass via build upload |
| CVE-2026-100623 | CA capgo.app Cap-go | 8.8 | Sep 26 | Capgo Authentication Bypass via Direct PostgREST org_users Table Write |
| CVE-2026-100622 | CA capgo.app Cap-go | 7.5 | Sep 26 | capgo.app through 12.129.0 Cache Restoration of Deleted Bundles |
| CVE-2026-100621 | CA capgo.app Cap-go | 4.3 | Sep 26 | capgo.app Content-Lock Bypass via r2-direct Bundle Mutation |
| CVE-2026-100620 | CA @capgo/cli Cap-go | 3.8 | Sep 26 | Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account |
| CVE-2026-100619 | CA capgo.app Cap-go | 8.8 | Sep 26 | Capgo OTA Manifest Poisoning via app_versions.manifest Bypass |
| CVE-2026-100618 | CA capgo.app Cap-go | 8.5 | Sep 26 | Capgo App Icon Update Privilege Escalation via Service-Role Worker |
| CVE-2026-100617 | CA capgo.app Cap-go | 8.8 | Sep 26 | Cap-go capgo.app Authorization Bypass via channel_permission_overrides |
| CVE-2026-100616 | CA capgo.app Cap-go | 5.5 | Sep 26 | capgo.app Authentication Bypass via PostgREST customer_id Mutation |
| CVE-2026-100615 | CA capgo.app Cap-go | 8.8 | Sep 26 | Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation |
| CVE-2026-100614 | CA capgo.app Cap-go | 8.8 | Sep 26 | Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker |
| CVE-2026-100613 | CA capgo.app Cap-go | 5.3 | Sep 26 | capgo.app Authorization Bypass via Stale Channel Permission Overrides |
| CVE-2026-100612 | CA capgo.app Cap-go | 7.2 | Sep 26 | Capgo SSO Provider ID Authentication Bypass via Incomplete Migration |
| CVE-2026-100611 | CA capgo.app Cap-go | 6.5 | Sep 26 | Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list |
| CVE-2026-88864 | CA capgo.app Cap-go | 9.1 | Sep 10 | Capgo SSO Provider Authentication Bypass via PostgREST Direct Write |
| CVE-2026-88863 | CA capgo.app Cap-go | 8.1 | Sep 10 | capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org |
| CVE-2026-88862 | CA capgo.app Cap-go | 8.8 | Sep 10 | Capgo API Key Manager Authentication Bypass via x-limited-key-id |
| CVE-2026-88861 | CA capgo.app Cap-go | 8.3 | Sep 10 | Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization |
| CVE-2026-88860 | CA capgo.app Cap-go | 6.3 | Sep 10 | Capgo Authorization Bypass via Stale Channel Permission Overrides |
| CVE-2026-56339 | CA capgo Cap-go | 7.5 | Jul 15 | Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC |
| CVE-2026-56296 | CA capgo Cap-go | 5.3 | Jul 11 | Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC |
| CVE-2026-56284 | CA capgo Cap-go | 5.3 | Jul 8 | Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC |
| CVE-2026-56226 | CA capgo Cap-go | 7.5 | Jul 8 | Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC |
| CVE-2026-56310 | CA capgo Cap-go | 4.3 | Jun 24 | Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass |
| CVE-2026-56245 | CA capgo Cap-go | 8.2 | Jun 24 | Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC |
| CVE-2026-56248 | CA capgo Cap-go | 7.5 | Jun 23 | Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy |
| CVE-2026-56280 | CA capgo Cap-go | 7.1 | Jun 22 | Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect |
| CVE-2026-56221 | CA capgo Cap-go | 6.5 | Jun 22 | Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts |
| CVE-2026-56316 | CA capgo Cap-go | 5.3 | Jun 21 | Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/* |
| CVE-2026-56307 | CA capgo Cap-go | 4.3 | Jun 20 | Cap-go - Broken Cursor Pagination in /private/devices Endpoint |
| CVE-2026-56235 | CA capgo Cap-go | 5.3 | Jun 20 | Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions |
| CVE-2026-56082 | CA capgo Cap-go | 7.5 | Jun 19 | Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC |
| CVE-2026-56081 | CA capgo Cap-go | 9.1 | Jun 19 | Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email |
| CVE-2026-56080 | CA capgo Cap-go | 4.9 | Jun 19 | Cap-go - Authentication Logic Flaw in Enforce Password Policy |
| CVE-2026-56073 | CA capgo Cap-go | 9.4 | Jun 19 | Cap-go - OTP Bypass via Response Manipulation in Email Verification |
| CVE-2026-53982 | CA capgo Cap-go | 6.5 | Jun 12 | Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association |
| CVE-2026-53981 | CA Cap-go Cap-go | 7.6 | Jun 12 | Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism |