guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
CVE-2026-55734
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) a
2026-08-02 归档
今日共收录 946 条安全情报，包含 146 个 CVE，466 篇安全通告，以及 75 篇研究论文。
← 返回归档列表Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
CVE-2026-67311
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fail
axios before 0.33.0 Denial of Service via maxDepth bypass
CVE-2026-67321
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level k
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-67333
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi
axios before 0.33.0 Prototype Pollution via nested option objects
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
axios before 1.18.0 Prototype Pollution via bodyless methods
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
axios 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
CVE-2026-67315
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re
axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (
Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
CVE-2026-67307
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inven
@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling
better-auth before 1.1.16 Reflected XSS via error parameter
CVE-2025-71404
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
CVE-2026-66402
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in
better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
axios before 1.18.0 Prototype Pollution via auth subfields
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes...
CVE-2026-67309
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
CVE-2026-54768
## Summary The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The r