Input Validation and Logic

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCVE-2026-56338Capgo · CVSS 5.3 · 0.5% likely

   CWE-703

2. Capgo - Denial of Service via Improper Password Policy Length ValidationCVE-2026-56228Capgo · CVSS 4.9 · 0.5% likely

   CWE-20

3. Capgo - Integrity Issue in Release Routing via Multiple Public ChannelsCVE-2026-56328Capgo · CVSS 6.5 · 0.3% likely

   CWE-670

4. Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain LookupCVE-2026-56325Capgo · CVSS 3.1 · 0.3% likely

   CWE-20

5. Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore DecodingCVE-2026-56329Capgo · CVSS 6.4 · 0.3% likely

   CWE-436

6. Capgo - Subkey Enforcement Bypass via x-limited-key-id Header ParsingCVE-2026-56306Capgo · CVSS 6.4 · 0.3% likely

   CWE-20

7. Capgo - Two-Factor Authentication Bypass via Organization Management APICVE-2026-56256Capgo · CVSS 7.1 · 0.3% likely

   CWE-602

8. Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesCVE-2026-56333Capgo · CVSS 4.3 · 0.3% likely

   CWE-20

9. Cap-go - Broken Cursor Pagination in /private/devices EndpointCVE-2026-56307Cap-go · CVSS 4.3 · 0.3% likely

   CWE-670

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.