CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,476
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product cap_go:capgo.app. Show all products

23 CVEs, showing 1 to 23
CVESeverityTitlePublished
CVE-2026-100626Medium 4.3capgo through 12.128.2 IDOR via PUT /app icon endpoint
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100629Medium 5.5Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100628Medium 4.3capgo.app before 12.128.12 Authentication Bypass via apikey
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100627High 8.1Capgo bundle promotion API channel RBAC deny override bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100625High 7.1Capgo Build Upload Proxy Authorization Bypass via TUS Resource
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100624Medium 5.4Capgo.app before 12.264.5 Upload Expiry Bypass via build upload
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100623High 8.8Capgo Authentication Bypass via Direct PostgREST org_users Table Write
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100622High 7.5capgo.app through 12.129.0 Cache Restoration of Deleted Bundles
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100621Medium 4.3capgo.app Content-Lock Bypass via r2-direct Bundle Mutation
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100619High 8.8Capgo OTA Manifest Poisoning via app_versions.manifest Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100618High 8.5Capgo App Icon Update Privilege Escalation via Service-Role Worker
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100617High 8.8Cap-go capgo.app Authorization Bypass via channel_permission_overrides
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100616Medium 5.5capgo.app Authentication Bypass via PostgREST customer_id Mutation
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100615High 8.8Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100614High 8.8Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100613Medium 5.3capgo.app Authorization Bypass via Stale Channel Permission Overrides
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100612High 7.2Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100611Medium 6.5Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-88864Critical 9.1Capgo SSO Provider Authentication Bypass via PostgREST Direct Write
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88863High 8.1capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88862High 8.8Capgo API Key Manager Authentication Bypass via x-limited-key-id
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88861High 8.3Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88860Medium 6.3Capgo Authorization Bypass via Stale Channel Permission Overrides
Assigned by VulnCheck
Sep 10, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.