GHSA-P2FR-6HMX-4528 @better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the JWT validation process. An attacker can gain unauthorized access by presenting a validly signed token from a trusted issuer, originally intended for a different service, to the authentication system. This ...

CVE-2026-35041 ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification

fast-jwt provides fast JSON Web Token JWT implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is attacker-controlled and the library evaluates it against the...

Linux Distros Unpatched Vulnerability : CVE-2024-48898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permissi...

SUSE CVE-2025-32963

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the spec.audiences field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it...

MinIO Operator 安全漏洞

MinIO Operator is a simple Kubernetes operator for MinIO clusters from MinIO. A security vulnerability exists in MinIO Operator versions prior to 7.1.0, which stems from the failure to provide an audiences field, which could result in tokens being replayed...

Moodle 4.2.x < 4.2.11 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.11, 4.3.x prior to 4.3.8, or 4.4.x prior to 4.4.4. It is, therefore, affected by multiple vulnerabilities. - An IDOR when fetching report schedules. - Some users can...

UBUNTU-CVE-2024-48898

A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from...

Missing Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Missing Authorization via the execute function of the delete.php component. An attacker can manipulate permissions and delete audiences from reports they should not have access to by exploiting this...

PT-2024-8662 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A vulnerability was found in Moodle, related to the lack of authorization procedures. This issue allows users with access to delete audiences from reports to delete audiences from other...

Malicious code in momo-audiences (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2670 Malicious code in momo-audiences (npm)

--- -= Per source details. Do not edit below this line.=-...

UBUNTU-CVE-2024-33996

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to...

Unmasking Doppelgänger: Russia’s Disinformation Campaign Revealed

Summary: Doppelgänger, a suspected Russia-aligned influence operation network targeting German audiences with propaganda and disinformation, potentially aiming to sway opinions ahead of elections. Doppelgänger employs coordinated social media activities and a dynamic infrastructure to maximize it...

Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.

In June 2019, Mandiant Threat Intelligence first reported to customers a pro-People’s Republic of China PRC network of hundreds of inauthentic accounts on Twitter, Facebook, and YouTube, that was at that time primarily focused on discrediting pro-democracy protests in Hong Kong. Since then, the...

What's New in Edge Delivery

Welcome to day two of the Akamai Platform Update! Today, we're focusing on Akamai's edge delivery products as well as other complimentary products that help drive great digital experiences. The last several months have been nothing short of unprecedented as lockdowns, quarantines, and other...

Facebook Auto-UnLiker — Your Facebook Page 'Likes' Might Drop This Week

Do you own a Facebook Business page? If yes, then you will notice a drop in the number of "likes" on your Facebook Page by next week, which could be quite disappointing but, Facebook believes, will help business to know their actual followers. FACEBOOK'S OFFICIAL MASS AUTO-UNLIKE The social netwo...

New Mozilla Privacy Initiative to Include High-Capacity Tor Relays

Mozilla is starting a new initiative that the company says is designed to incorporate more privacy enhancing features into Firefox and the other Mozilla products. The project, known as Polaris, involves collaboration with The Tor Project and the Center for Democracy and Technology and will involv...