Vulnerabilidades en Capgo
83 resultadosAnálisis Vexday
Capgo apresenta 82 vulnerabilidades catalogadas, todas publicadas nos últimos 90 dias, indicando exposição recente e significativa. Embora nenhuma esteja sob ataque ativo no momento, apenas 2 são críticas, a fraqueza dominante é exposição de informações (CWE-200), sugerindo vazamento de dados como padrão de risco principal. A concentração de divulgações recentes demanda monitoramento contínuo para detecção precoce de exploração em larga escala.
CVE-2026-56299MEDIUMCapgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload EndpointEPSS 0.7%CVE-2026-56323HIGHCapgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_selfEPSS 0.6%CVE-2026-56233HIGHCapgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyEPSS 0.6%CVE-2026-56238HIGHCapgo - Unauthenticated Information Disclosure via PostgREST global_stats EndpointEPSS 0.6%CVE-2026-56286HIGHCapgo - Account Deletion Without Password ConfirmationEPSS 0.5%CVE-2026-56222HIGHCapgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindingsEPSS 0.5%CVE-2026-56237CRITICALCapgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationEPSS 0.5%CVE-2026-56305HIGHCapgo - Authentication Bypass in Password Change via Missing Current Password ValidationEPSS 0.5%CVE-2026-56313HIGHCapgo - Cross-Organization Account Disruption via SSO Prelink EndpointEPSS 0.5%CVE-2026-56338MEDIUMCapgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointEPSS 0.5%CVE-2026-56232HIGHCapgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderEPSS 0.5%CVE-2026-56230HIGHCapgo - Broken Object Level Authorization via x-limited-key-id HeaderEPSS 0.5%CVE-2026-56228MEDIUMCapgo - Denial of Service via Improper Password Policy Length ValidationEPSS 0.5%CVE-2026-56324HIGHCapgo - Rate Limit Bypass via User-Controlled device_id ParameterEPSS 0.5%CVE-2026-56214HIGHCapgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPCEPSS 0.5%CVE-2026-56300HIGHCapgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsEPSS 0.5%CVE-2026-56322HIGHCapgo - Information Disclosure via Unauthenticated /updates defaultChannel ParameterEPSS 0.5%CVE-2026-56303HIGHCapgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC FunctionEPSS 0.5%CVE-2026-56321MEDIUMCapgo - Missing Authentication Middleware on GET /private/role_bindings EndpointEPSS 0.5%CVE-2026-56250HIGHCapgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versionsEPSS 0.5%