Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 1821–1840 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100631

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:07.125Z. Updated 2026-09-28T18:55:55.755Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:55 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100630

AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1821 to 1840 of 14934.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:06.440Z. Updated 2026-10-03T23:44:08.065Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Oct 2026, 06:44 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100629

Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the role currently bou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:05.748Z. Updated 2026-10-05T16:08:07.601Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 23:08 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100628

capgo.app before 12.128.12 Authentication Bypass via apikey

capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey endpoint, requests that supply app_id but omit org_id, limited_to_orgs, and expires_at resolve the target app and scope the key to it, but never add the app's owner organization…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:05.038Z. Updated 2026-09-28T16:57:24.802Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Sep 2026, 23:57 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100627

Capgo bundle promotion API channel RBAC deny override bypass

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id })…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:04.377Z. Updated 2026-09-30T17:20:12.880Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100625

Capgo Build Upload Proxy Authorization Bypass via TUS Resource

Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but then forwards the user-controlled TUS resource suffix taken f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:03.030Z. Updated 2026-09-30T17:20:12.129Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100624

Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build request is created, an upload_expires_at timestamp (one hour) and a 'pending' status are stored in build_requests, but the upload proxy loads only app_id, owner_org, buil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:02.328Z. Updated 2026-10-05T15:09:27.899Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 22:09 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100623

Capgo Authentication Bypass via Direct PostgREST org_users Table Write

Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization (public.check_min_rights('admin', ...));…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:01.631Z. Updated 2026-09-30T17:20:11.439Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100622

capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects into R2 storage on cache hits.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:00.943Z. Updated 2026-09-28T18:58:31.793Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 01:58 WIB

Official record

MedPublished 26 Sep 2026, 20:23 WIB

CVE-2026-100621

capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_encrypted_bundle_trigger` / `check_encrypted_bundle_on_insert` content lock in supabase/schemas/prod.sql exempts `app_versions` rows whose previou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:23:00.259Z. Updated 2026-09-30T17:20:10.724Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

MedPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100620

Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL (passed as develope…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:59.577Z. Updated 2026-10-05T16:01:42.492Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 23:01 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100619

Capgo OTA Manifest Poisoning via app_versions.manifest Bypass

Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key (upload+ rights) or an authenticated user with write+ rights on an app can update public.a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:58.881Z. Updated 2026-09-30T17:20:09.972Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100618

Capgo App Icon Update Privilege Escalation via Service-Role Worker

Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the target app's own image namespace (e.g. org/{owner_org}/{app_id}/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:58.212Z. Updated 2026-09-30T17:20:09.244Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100617

Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:57.529Z. Updated 2026-09-30T17:20:08.539Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100616

capgo.app Authentication Bypass via PostgREST customer_id Mutation

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin (a user holding org.update_settings) to update the entire row, including the internal billing pointer column customer_id. The offic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:56.806Z. Updated 2026-10-05T16:03:57.612Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated05 Oct 2026, 23:03 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100615

Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:56.128Z. Updated 2026-09-28T17:11:42.579Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 00:11 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100614

Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:55.404Z. Updated 2026-09-28T19:04:52.158Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Sep 2026, 02:04 WIB

Official record

MedPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100613

capgo.app Authorization Bypass via Stale Channel Permission Overrides

capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at time of publication), the `transfer_app()` database function transfers an app, its channels, versions and related records to a destination organization without deleting o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:54.681Z. Updated 2026-09-30T17:20:07.148Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100612

Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:53.997Z. Updated 2026-09-30T20:11:12.994Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:11 WIB

Official record

HighPublished 26 Sep 2026, 20:22 WIB

CVE-2026-100611

Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API keys. When an authenticated user holding only apikey_manager (permissions org.manage_apikeys and org.read) calls POST /apikey with a JWT session, the only checks applied are…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-26T13:22:53.315Z. Updated 2026-09-30T17:20:05.706Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record