Information Disclosure

Every one of the 25 is a mark on the map. Named now: 1 to 25, most at risk first.

1. Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfCVE-2026-56323Capgo · CVSS 7.5 · 0.6% likely

   CWE-200

2. Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointCVE-2026-56238Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

3. Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCVE-2026-56322Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

4. Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionCVE-2026-56303Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

5. Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCVE-2026-56300Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

6. Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCVE-2026-56214Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

7. Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCVE-2026-56242Capgo · CVSS 7.5 · 0.4% likely

   CWE-200

8. Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2CVE-2026-56337Capgo · CVSS 5.3 · 0.4% likely

   CWE-200

9. capgo.app through 12.129.0 Cache Restoration of Deleted BundlesCVE-2026-100622Cap-go · CVSS 7.5 · 0.4% likely

   CWE-200

10. Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook AccessCVE-2026-56079Capgo · CVSS 6.5 · 0.4% likely

    CWE-200

11. Capgo - Information Disclosure via Unauthenticated /replication EndpointCVE-2026-56282Capgo · CVSS 5.3 · 0.4% likely

    CWE-200

12. Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCCVE-2026-56339Cap-go · CVSS 7.5 · 0.4% likely

    CWE-203

13. Capgo - Information Disclosure via /private/validate_password_compliance EndpointCVE-2026-56318Capgo · CVSS 5.3 · 0.4% likely

    CWE-200

14. Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC FunctionsCVE-2026-56235Cap-go · CVSS 5.3 · 0.3% likely

    CWE-200

15. Capgo - Information Disclosure via Unauthenticated SSO check-domain EndpointCVE-2026-56336Capgo · CVSS 5.3 · 0.3% likely

    CWE-200

16. Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringCVE-2026-56331Capgo · CVSS 5.3 · 0.3% likely

    CWE-209

17. Capgo - EXIF Metadata Exposure via Image UploadCVE-2026-56218Capgo · CVSS 5.3 · 0.3% likely

    CWE-200

18. Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCCVE-2026-56327Capgo · CVSS 5.3 · 0.3% likely

    CWE-203

19. Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPCCVE-2026-56226Cap-go · CVSS 7.5 · 0.3% likely

    CWE-200

20. Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*CVE-2026-56316Cap-go · CVSS 5.3 · 0.3% likely

    CWE-203

21. Cap-go - App Existence Oracle via Unauthenticated transfer_app RPCCVE-2026-56296Cap-go · CVSS 5.3 · 0.3% likely

    CWE-203

22. Capgo - App Existence Oracle via GET /statistics/app/:app_idCVE-2026-56319Capgo · CVSS 4.3 · 0.3% likely

    CWE-203

23. Capgo - EXIF Metadata Exposure in App Information Image UploadCVE-2026-56298Capgo · CVSS 4.3 · 0.3% likely

    CWE-200

24. Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPCCVE-2026-56284Cap-go · CVSS 5.3 · 0.3% likely

    CWE-200

25. Capgo - Webhook Signing Secret Disclosure via Non-Admin API KeyCVE-2026-56244Capgo · CVSS 7.1 · 0.2% likely

    CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.