guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
CVE-2026-55734
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) a
#advisory
共收录 23627 条相关情报。
← 返回所有主题Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
CVE-2026-55733
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
CVE-2026-54894
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom c
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
CVE-2026-55735
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a vi
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url...
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ....
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in...
CVE-2026-67354
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the...
CVE-2026-67355
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the...
CVE-2026-67353
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0...
CVE-2026-67330
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through = 1.7.0-beta.0 through <= 1.7.0-beta.9 contai
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java...
CVE-2026-67340
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to...
CVE-2026-67333
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE...
CVE-2026-67341
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored...
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to vali
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider...
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that adve
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the...
CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin,...
CVE-2026-67334
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM...
CVE-2026-67331
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b