@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-67332
@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing
#cwe-285
共收录 628 条相关情报。
← 返回所有主题An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an aut...
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Googl
BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Googl
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An atta...
CVE-2026-18207
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group m
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel
CVE-2026-49446
### Summary The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to th
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin chec...
CVE-2026-47726
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
CVE-2026-47726
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, intern
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write AC...
CVE-2026-61487
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A...
CVE-2026-64743
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, ma
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app...
CVE-2026-64711
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequ
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data.
CVE-2026-43792
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be able to access sensitive user d...
CVE-2026-43775
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensi...
CVE-2026-43756
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built...
CVE-2026-64642
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component ...
CVE-2026-17531
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/a...
CVE-2026-17530
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument...
CVE-2026-17529
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/
unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization
CVE-2026-17531
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server....
CVE-2026-17434
CVE-2026-17434 影响 nanocoai NanoClaw 2.0.64 及之前版本，存在于组件 add_mcp_server 的 src/modules/self-mod/request.ts 文件中的 handleAddMc