Cap-go vulnerabilities
42 CVEs and advisories name Cap-go as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-56248Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
- CVE-2026-56280Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect
- CVE-2026-56221Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts
- CVE-2026-56316Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/
- CVE-2026-56307Cap-go - Broken Cursor Pagination in /private/devices Endpoint
- CVE-2026-56235Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions
- CVE-2026-56082Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC
- CVE-2026-56081Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email
- CVE-2026-56080Cap-go - Authentication Logic Flaw in Enforce Password Policy
- CVE-2026-56073Cap-go - OTP Bypass via Response Manipulation in Email Verification
- CVE-2026-53982Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association
- CVE-2026-53981Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism