tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

UBUNTU-CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

UBUNTU-CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

EUVD-2026-51827

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67323

GitPython < 3.1.51 is affected. The vulnerability stems from failing to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), enabling command injection via options like --exec and --upload-pack. Additionally, Repo.iter_commits() and Repo.blame(...

CVE-2026-67316

axios is a widely-used Node.js and browser HTTP client. CVE-2026-67316 is a read-side prototype-pollution gadget in the bodyless method aliases (get(), delete(), head(), options()): when Object.prototype has already been polluted by another dependency, inherited data is read via (config || {}).da...

CVE-2026-67335 better-auth before 1.6.2 OAuth State Validation Bypass

better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...

CVE-2026-67335

Affected software: better-auth before 1.6.2. Vulnerability: OAuth state validation failure due to cookie-backed state storage without PKCE, allowing attackers to forge the state and supply an attacker-controlled authorization code. Impact: can create authenticated sessions bound to the attacker's...

CVE-2026-67335 better-auth before 1.6.2 OAuth State Validation Bypass

better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the...

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

EUVD-2026-51848

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...

CVE-2026-67320

CVE-2026-67320 affects axios on Node.js when using the HTTP adapter. A hardened config object can be re-exposed to regular objects via common patterns, allowing an attacker to pollute Object.prototype.proxy and route plaintext-HTTP requests through a malicious proxy. Impact includes exposure of A...

CVE-2026-67327

Better-Auth before 1.6.22 is vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers a victims email with a chosen password; the account remains unverified. When the victim signs in later...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

UBUNTU-CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...