better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that adve
#advisory
共收录 23627 条相关情报。
← 返回所有主题GitPython before 3.1.50 Newline Injection via config_writer section
CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attac
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
CVE-2026-67340
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b
axios before 0.33.0 Denial of Service via maxDepth bypass
CVE-2026-67321
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level k
FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure
CVE-2026-67292
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/cor
better-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-67333
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi
axios before 0.33.0 Prototype Pollution via nested option objects
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
GitPython 3.1.50 Authentication Bypass via Joined Short Options
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE
CVE-2026-67344
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP
@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2026-67329
@better-auth/stripe versions >= 1.4.11 and = 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organi
GitPython before 3.1.51 Command Injection via unguarded Git options
CVE-2026-67323
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and g
axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2
CVE-2026-67318
axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo
axios before 1.18.0 Prototype Pollution via bodyless methods
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
better-auth Stale Sessions Persist After User Deletion
CVE-2026-67334
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp
axios 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
CVE-2026-67315
axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re
axios 0.28.0 before 0.33.0 Denial of Service via formToJSON
CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2025-71403
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
CVE-2026-66401
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fail
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
CVE-2026-67341
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with
Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
CVE-2026-67307
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inven