better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when...
CVE-2026-67337
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is e
#advisory
共收录 23627 条相关情报。
← 返回所有主题ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1...
CVE-2026-67343
ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing a
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers...
CVE-2026-67339
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request...
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in...
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing...
CVE-2026-67321
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level k
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10,...
CVE-2026-67329
@better-auth/stripe versions >= 1.4.11 and = 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organi
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()....
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
GitPython before 3.1.50 fails to validate newline characters in the section parameter of...
CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attac
better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0...
CVE-2026-67327
better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account...
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments...
CVE-2026-67323
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and g
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes...
CVE-2026-67309
Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and...
CVE-2026-67307
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inven
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit...
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing...
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST...
CVE-2026-67311
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fail