Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,146All CVEsplus 19,141 rejected
- 213Last 24 hours3,231 in the last 7 days
- 16,929Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 42 | 38 | 1 | 0 | 83 | 83 |
| Title | ||
|---|---|---|
| CVE-2026-56336 | Capgo - Information Disclosure via Unauthenticated SSO check-domain EndpointPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56313 | Capgo - Cross-Organization Account Disruption via SSO Prelink EndpointCapgo · Capgo | High7.2 |
| CVE-2026-56308 | Capgo - Insufficient Authentication in Email Change EndpointPublic exploitCapgo · Capgo | High8.4 |
| CVE-2026-56281 | Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats EndpointPublic exploitCapgo · Capgo | Medium5.1 |
| CVE-2026-56252 | Capgo - Scope Isolation Failure in Webhook Test EndpointPublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56241 | Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_rightPublic exploitCapgo · Capgo | High7.2 |
| CVE-2026-56238 | Capgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56303 | Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56240 | Capgo - Billing Authorization Bypass via Exhausted Usage CreditsPublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56335 | Capgo - Channel Configuration Mutation via Write-Scoped API KeysPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56329 | Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore DecodingPublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56312 | Capgo - Account Creation Before CAPTCHA Validation in accept_invitation EndpointCapgo · Capgo | Medium6.9 |
| CVE-2026-56309 | Capgo - Plan Bypass via Unrestricted Attachment Upload EndpointPublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56305 | Capgo - Authentication Bypass in Password Change via Missing Current Password ValidationPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56279 | Capgo - Information Disclosure via get_orgs_v7 RPC EndpointPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56298 | Capgo - EXIF Metadata Exposure in App Information Image UploadCapgo · Capgo | Medium5.3 |
| CVE-2026-56293 | Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()Public exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56283 | Capgo - HTML Injection Leading to Open Redirection in Organization SettingsPublic exploitCapgo · Capgo | Medium4.8 |
| CVE-2026-56250 | Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56246 | Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege InheritancePublic exploitCapgo · Capgo | High7.2 |
| CVE-2026-56220 | Capgo - Unauthorized Manifest Insertion via Read-Only Org MemberPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56217 | Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST UpdatePublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56334 | Capgo - Missing UPDATE RLS Policy for Build Status PersistencePublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56333 | Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesPublic exploitCapgo · Capgo | Medium5.3 |
| CVE-2026-56331 | Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56328 | Capgo - Integrity Issue in Release Routing via Multiple Public ChannelsPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56327 | Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56320 | Capgo - Org/App Scope Mismatch in Device Creation EndpointPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56318 | Capgo - Information Disclosure via /private/validate_password_compliance EndpointPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56300 | Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56286 | Capgo - Account Deletion Without Password ConfirmationPublic exploitCapgo · Capgo | High7.0 |
| CVE-2026-56249 | Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionPublic exploitCapgo · Capgo | High7.2 |
| CVE-2026-56247 | Capgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56233 | Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56230 | Capgo - Broken Object Level Authorization via x-limited-key-id HeaderCapgo · Capgo | High8.7 |
| CVE-2026-56224 | Capgo - Login CSRF and Session Fixation via URL Query ParametersPublic exploitCapgo · Capgo | Medium5.1 |
| CVE-2026-56219 | Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56338 | Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56337 | Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2Public exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56302 | Capgo - Unsecured Supabase Images Bucket via Missing Row Level SecurityPublic exploitCapgo · Capgo | Medium6.9 |
| CVE-2026-56257 | Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST UpdatePublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56256 | Capgo - Two-Factor Authentication Bypass via Organization Management APIPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56244 | Capgo - Webhook Signing Secret Disclosure via Non-Admin API KeyPublic exploitCapgo · Capgo | High7.1 |
| CVE-2026-56237 | Capgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationPublic exploitCapgo · Capgo | Critical9.3 |
| CVE-2026-56232 | Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56231 | Capgo - Broken Object Level Authorization in Build Job Control via jobId ParameterPublic exploitCapgo · Capgo | High7.2 |
| CVE-2026-56223 | Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userPublic exploitCapgo · Capgo | Critical9.3 |
| CVE-2026-56322 | Capgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterPublic exploitCapgo · Capgo | High8.7 |
| CVE-2026-56243 | Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS PlanePublic exploitCapgo · Capgo | High8.6 |
| CVE-2026-56234 | Capgo - Password Spraying via Public-Key Accessible Credential Validation EndpointPublic exploitCapgo · Capgo | Medium6.9 |