Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

CVE-2026-53514

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` with th

历史摘要 · 未重新核验 · GitHub Advisory

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

### Am I affected? Users are affected if all of the following hold: - Their application depends on `@better-auth/oaut

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

CVE-2026-53512

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has

历史摘要 · 未重新核验 · GitHub Advisory

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CVE-2026-53509

### Summary A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that acc

历史摘要 · 未重新核验 · GitHub Advisory

9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

CVE-2026-55501

## Summary The 9router dashboard login rate limiter derives the client identity from the attacker-controlled `X-Forward

历史摘要 · 未重新核验 · GitHub Advisory

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

CVE-2026-55500

## Summary The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAu

历史摘要 · 未重新核验 · GitHub Advisory

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: /

历史摘要 · 未重新核验 · GitHub Advisory

Decompress: Archive extraction can create files and links outside of the target directory

CVE-2026-53486

### Impact When extracting an archive to a directory, a crafted archive can read or write files outside that directory.

历史摘要 · 未重新核验 · GitHub Advisory

9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

CVE-2026-49353

## Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only a

历史摘要 · 未重新核验 · GitHub Advisory

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

CVE-2026-49352

### Summary 9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT s

历史摘要 · 未重新核验 · GitHub Advisory

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

## Summary The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `patt

历史摘要 · 未重新核验 · GitHub Advisory

@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write

## Summary The `matchFileSnapshot` function in `src/assertions/snapshots.ts` accepted a `filePath` parameter with zero

历史摘要 · 未重新核验 · GitHub Advisory

9router: Missing Authorization and OS Command Injection

# Unauthenticated RCE via `/api/tunnel/tailscale-install` **Affected:** `9router` (npm package) — current master (`v0.4

历史摘要 · 未重新核验 · GitHub Advisory

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

### Summary `UForm` and `UAuthForm` render a server-side `` element with no `method` and no `action` attribute, relying

历史摘要 · 未重新核验 · GitHub Advisory

jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

CVE-2026-52746

### Impact In JSONata `= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw MCP SSE redirects could forward Authorization headers

### Summary MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or config

历史摘要 · 未重新核验 · GitHub Advisory

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

CVE-2026-50143

## Actor MCP path authority injection leaks Apify token ### Summary `@apify/actors-mcp-server` version `0.10.7` builds

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

CVE-2026-53943

### Impact When Ghost is behind a shared caching layer that results in cached content being shared between different vi

历史摘要 · 未重新核验 · GitHub Advisory

@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

CVE-2026-48819

### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim int

历史摘要 · 未重新核验 · GitHub Advisory

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

CVE-2026-48795

### Summary The fix for [GHSA-f5x2-vj4h-vg4c](https://github.com/adonisjs/core/security/advisories/GHSA-f5x2-vj4h-vg4c)

历史摘要 · 未重新核验 · GitHub Advisory