Authorization Bypass

@better-auth/stripe is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent organization ID validation between the middleware and request handler, allowing authenticated users to perform unauthorized subscription actions and access billing information for other organizatio...

Linux Distros Unpatched Vulnerability : CVE-2026-67354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting...

Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h95v-h523-3mw8. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When...

CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

UBUNTU-CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

CVE-2026-67354

The CVE-2026-67354 entry applies to guzzlehttp/guzzle prior to 7.15.1, where RedirectMiddleware can disclose the URI fragment via the Referer header when allow_redirects.referer is enabled during same-scheme redirects. An attacker controlling the redirect destination may obtain sensitive data (e....

CVE-2026-67594

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via omission of the VerifyCsrfToken middleware in the global middleware stack. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious...

EUVD-2026-51276

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-66416

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-66416 Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

Security Bulletin: IBM Quantum Safe Explorer is affected by a security vulnerability (CVE-2026-55602)

Summary A security vulnerability was found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed the vulnerability by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION:...

PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

PT-2026-66545

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An issue exists where the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This allows unauthenticated attackers to perform state-changing actions on...

laravel-threat-detection v1.6.1

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...

laravel-threat-detection v1.5.0

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...

CakePHP 5.4.1 Released

CakePHP 5.4.1 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 5.4.1. This is a maintenance release for the 5.4 branch that fixes community reported issues, regressions and a security issue with RateLimitMiddleware. Thank you to yousukezan for reporting th...