CVE-2026-67331

CVE-2026-67331 affects better-auth SCIM, versions 1.5.0 up to but not including 1.7.0-beta.4. The vulnerability arises because non-organization SCIM providers are not bound to their creator by default, enabling an authenticated user to manage other users’ providers. Attackers can regenerate SCIM ...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402

The CVE affects better-auth versions >1.3.34 and

CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67330

The CVE affects @better-auth/scim (the better-auth SCIM plugin). Versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9 contain an authorization bypass caused by SCIM token issuance using provider IDs that collide with existing SSO/SAML/OIDC/generic OAuth/social provider name...

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67314

CVE-2026-67314 affects axios versions >=1.15.2 and

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

CVE-2026-55824

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-18211

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

EUVD-2026-51483

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access

HPE Smart Update Manager SUM prior to version 8.5.6 could allow remote unauthorized access. id: CVE-2020-7136 info: name: HPE Smart Update Manager 8.5.6 - Remote Unauthorized Access author: gy741 severity: critical description: HPE Smart Update Manager SUM prior to version 8.5.6 could allow remot...

CVE-2026-14541

The CVE concerns Google mcp-toolbox version 1.4.0 in its Google OAuth provider component. If an authService is initialized with mcpEnabled: true but without an explicit audience or clientId, the ValidateMCPAuth pipeline for opaque tokens omits audience validation. This causes the toolbox to accep...

CVE-2026-54363

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...

CVE-2026-66066: Defending Against the “KindaRails2Shell” Pre-Auth RCE

...

Cacti <=1.2.22 - Remote Command Injection

Cacti through 1.2.22 is susceptible to remote command injection. There is insufficient authorization within the remote agent when handling HTTP requests with a custom Forwarded-For HTTP header. An attacker can send a specially crafted HTTP request to the affected instance and execute arbitrary OS...