CVE Vulnerability Database
Search and browse 425,147 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-100630 | MEDIUM | 5.4 | 0.2% | Sep 26, 2026 | AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitiz... |
| CVE-2026-100629 | MEDIUM | 5.5 | 0.3% | Sep 26, 2026 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id... |
| CVE-2026-100628 | MEDIUM | 4.3 | — | Sep 26, 2026 | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API key... |
| CVE-2026-100627 | HIGH | 8.1 | 0.3% | Sep 26, 2026 | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle... |
| CVE-2026-100626 | MEDIUM | 4.3 | — | Sep 26, 2026 | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that a... |
| CVE-2026-100625 | HIGH | 7.1 | 0.3% | Sep 26, 2026 | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that auth... |
| CVE-2026-100624 | MEDIUM | 5.4 | 0.2% | Sep 26, 2026 | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy ... |
| CVE-2026-100623 | HIGH | 8.8 | 0.3% | Sep 26, 2026 | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's ... |
| CVE-2026-100622 | HIGH | 7.5 | — | Sep 26, 2026 | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file rea... |
| CVE-2026-100621 | MEDIUM | 4.3 | 0.2% | Sep 26, 2026 | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch ... |
| CVE-2026-100620 | LOW | 3.8 | 0.3% | Sep 26, 2026 | Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onb... |
| CVE-2026-100619 | HIGH | 8.8 | 0.3% | Sep 26, 2026 | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy... |
| CVE-2026-100618 | HIGH | 8.5 | 0.2% | Sep 26, 2026 | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a ... |
| CVE-2026-100617 | HIGH | 8.8 | 0.3% | Sep 26, 2026 | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing ... |
| CVE-2026-100616 | MEDIUM | 5.5 | 0.3% | Sep 26, 2026 | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security ... |
| CVE-2026-100615 | HIGH | 8.8 | — | Sep 26, 2026 | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager ... |
| CVE-2026-100614 | HIGH | 8.8 | — | Sep 26, 2026 | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image ... |
| CVE-2026-100613 | MEDIUM | 5.3 | 0.2% | Sep 26, 2026 | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current r... |
| CVE-2026-100612 | HIGH | 7.2 | 0.3% | Sep 26, 2026 | Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table.... |
| CVE-2026-100611 | MEDIUM | 6.5 | 0.2% | Sep 26, 2026 | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may... |
| CVE-2026-100610 | HIGH | 7.5 | — | Sep 26, 2026 | Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permis... |
| CVE-2026-100609 | MEDIUM | 6.8 | 0.2% | Sep 26, 2026 | Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on ... |
| CVE-2026-100608 | HIGH | 8.3 | 0.3% | Sep 26, 2026 | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode w... |
| CVE-2026-100607 | HIGH | 7.7 | — | Sep 26, 2026 | Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi... |
| CVE-2026-100606 | HIGH | 7.7 | — | Sep 26, 2026 | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login pat... |