ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP
2026-08-02 归档
今日共收录 946 条安全情报，包含 146 个 CVE，466 篇安全通告，以及 75 篇研究论文。
← 返回归档列表@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2026-67329
@better-auth/stripe versions >= 1.4.11 and = 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organi
GitPython before 3.1.51 Command Injection via unguarded Git options
CVE-2026-67323
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and g
better-auth Stale Sessions Persist After User Deletion
CVE-2026-67334
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2025-71403
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
CVE-2026-66401
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fail
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
CVE-2026-67341
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with
FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
CVE-2026-67302
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redire
FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE
CVE-2026-67306
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder fu
@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing
better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
CVE-2026-67337
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is e
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
CVE-2026-67310
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in t
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controll
better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-67327
better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account
FreeRDP before 3.29.0 TLS Certificate EKU Bypass
CVE-2026-67294
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-si
ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server
CVE-2026-67343
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a
FreeRDP before 3.29.0 Denial of Service via RDPEI PDU
CVE-2026-67296
FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to valid
guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope
CVE-2026-67355
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain
better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67331
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
CVE-2026-67304
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when