Capgo

Every one of the 99 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointCVE-2026-56299Capgo · CVSS 5.3 · 0.7% likely

   CWE-306

2. Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfCVE-2026-56323Capgo · CVSS 7.5 · 0.6% likely

   CWE-200

3. Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyCVE-2026-56233Capgo · CVSS 8.3 · 0.6% likely

   CWE-22

4. Capgo - Account Deletion Without Password ConfirmationCVE-2026-56286Capgo · CVSS 8.1 · 0.5% likely

   CWE-306

5. Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsCVE-2026-56222Capgo · CVSS 7.2 · 0.5% likely

   CWE-639

6. Capgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationCVE-2026-56237Capgo · CVSS 9.1 · 0.5% likely

   CWE-287

7. Capgo - Cross-Organization Account Disruption via SSO Prelink EndpointCVE-2026-56313Capgo · CVSS 8.1 · 0.5% likely

   CWE-285

8. Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCVE-2026-56338Capgo · CVSS 5.3 · 0.5% likely

   CWE-703

9. Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointCVE-2026-56238Capgo · CVSS 7.5 · 0.5% likely

   CWE-200

10. Capgo - Broken Object Level Authorization via x-limited-key-id HeaderCVE-2026-56230Capgo · CVSS 8.8 · 0.5% likely

    CWE-639

11. Capgo - Denial of Service via Improper Password Policy Length ValidationCVE-2026-56228Capgo · CVSS 4.9 · 0.5% likely

    CWE-20

12. Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterCVE-2026-56322Capgo · CVSS 7.5 · 0.5% likely

    CWE-200

13. Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionCVE-2026-56303Capgo · CVSS 7.5 · 0.5% likely

    CWE-200

14. Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCVE-2026-56300Capgo · CVSS 7.5 · 0.5% likely

    CWE-200

15. Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCCVE-2026-56214Capgo · CVSS 7.5 · 0.5% likely

    CWE-200

16. Capgo - Missing Authentication Middleware on GET /private/role_bindings EndpointCVE-2026-56321Capgo · CVSS 5.3 · 0.5% likely

    CWE-306

17. Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsCVE-2026-56250Capgo · CVSS 7.5 · 0.5% likely

    CWE-862

18. Capgo - Authentication Bypass in Password Change via Missing Current Password ValidationCVE-2026-56305Capgo · CVSS 8.3 · 0.4% likely

    CWE-620

19. Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassCVE-2026-56219Capgo · CVSS 7.5 · 0.4% likely

    CWE-287

20. Capgo - Privilege Escalation via Broken Row Level Security in org_usersCVE-2026-56251Capgo · CVSS 6.5 · 0.4% likely

    CWE-266

21. Capgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentCVE-2026-56247Capgo · CVSS 8.8 · 0.4% likely

    CWE-266

22. Capgo - Scope Escalation via API Key Creation in /functions/v1/apikeyCVE-2026-56216Capgo · CVSS 8.8 · 0.4% likely

    CWE-269

23. Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPCCVE-2026-56242Capgo · CVSS 7.5 · 0.4% likely

    CWE-200

24. Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2CVE-2026-56337Capgo · CVSS 5.3 · 0.4% likely

    CWE-200

25. Cap-go - Account Lockout via 2FA Misconfiguration on Unverified EmailCVE-2026-56081Cap-go · CVSS 9.1 · 0.4% likely

    CWE-640

26. Capgo - Information Disclosure via get_orgs_v7 RPC EndpointCVE-2026-56279Capgo · CVSS 7.5 · 0.4% likely

    CWE-862

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.