9805 matches found
CVE-2025-27143
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...
DEBIAN-CVE-2024-12368
Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: timoni, gitea, configmap-reload, go-licenses, kube-fluentd-operator, delve, swagger, ini-file, paranoia, aws-application-networking-k8s, octo-sts, trillian, gptscript, whereabouts, cortex, kserve-rest-proxy, q, stakater-reloader, lvm-driver, hivemind, flannel, elvish...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: goreleaser, cfssl, metallb, timoni, gke-gcloud-auth-plugin, memcached-exporter, configmap-reload, nri-discovery-kubernetes, go-licenses, delve, rqlite, slsa-verifier, kwok, actions-runner-controller, paranoia, php-fpmexporter, supercronic, hey, prometheus-alertmanage...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: goreleaser, cfssl, metallb, timoni, gke-gcloud-auth-plugin, memcached-exporter, configmap-reload, nri-discovery-kubernetes, go-licenses, delve, rqlite, slsa-verifier, kwok, actions-runner-controller, paranoia, php-fpmexporter, supercronic, hey, prometheus-alertmanage...
CVE-2025-27143
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...
CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...
CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...
@better-auth/cli (>=1.0.0-canary.2, <=1.1.20), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-71403 via better-auth (>=1.0.0, <=1.1.20-beta.5)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-71403 Source advisory: OSV:GHSA-VP58-J275-797X...
@better-auth/cli (>=1.0.0-canary.2, <=1.1.19), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-27143 via better-auth (>=1.0.0, <=1.1.19-beta.3)
better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-27143 Source advisory: OSV:GHSA-HJPM-7MRM-26W8...
Better Auth ่พๅ ฅ้ช่ฏ้่ฏฏๆผๆด
Better Auth is a TypeScript's most comprehensive authentication framework open-sourced by Better Auth. An input validation error vulnerability exists in versions of Better Auth prior to 1.1.21 that stems from improper validation of the callbackURL parameter in the email validation endpoint and an...
CVE-2025-27112: Improper Authentication
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...
PT-2025-62897
Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.1.20 Description A flaw exists in the trustedOrigins validation logic concerning absolute URLs and wildcard domain patterns. This allows an attacker to craft a malicious callbackURL parameter that bypasses origi...
CVE-2025-27143: URL Redirection to Untrusted Site
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While...
OESA-2025-1170 etcd security update
%expand: Security Fixes: Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-28235 Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.CVE-2022-3064 Etcd v3.5.4 allows remote...
CVE-2024-57049
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2024-32638
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue...
CVE-2024-27348
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue...
The vulnerability of the TypeScript-based authentication library Better Auth, related to the lack of protective measures for website structure, allows attackers to perform cross-site scripting attacks.
The vulnerability of the TypeScript-based authentication library Better Auth relates to the lack of measures taken to protect the website structure when processing the error parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
February Microsoft Patch Tuesday
February Microsoft Patch Tuesday. 89 CVEs, 33 added since January. Two with signs of exploitation in the wild: EoP - Windows Ancillary Function Driver for WinSock CVE-2025-21418 EoP - Windows Storage CVE-2025-21391 There are no vulnerabilities with public exploits, but there are 7 with private...