better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67331
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b
#advisory
共收录 23634 条相关情报。
← 返回所有主题axios before 0.33.0 Prototype Pollution via Node HTTP adapter
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
CVE-2026-67304
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when
JupyterLab before 4.5.9 Stored XSS via Extension Manager
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to vali
guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service
CVE-2026-67353
guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimit
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
CVE-2026-66402
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in
better-auth before 1.6.2 OAuth State Validation Bypass
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure
CVE-2026-67339
guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR
GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem
FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response
CVE-2026-67297
FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses
FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy
CVE-2026-67301
FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC an
GitPython before 3.1.51 Command Injection via option prefix abbreviation
CVE-2026-67325
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p
FreeRDP before 3.29.0 Improper Certificate Hostname Validation
CVE-2026-67293
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability.
ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P
FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
CVE-2026-67305
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when
axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream
CVE-2026-67317
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch a
better-auth before 1.4.0 Session Revocation via Forged Cookie
CVE-2025-71402
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-ou
axios before 1.18.0 Prototype Pollution via auth subfields
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF
CVE-2026-67290
FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
CVE-2026-67313
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names wi