CVE-2026-53516: Improper Authentication

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts emailverified: true without requiring the local user row's emailVerified...

CVE-2026-53515: Improper Privilege Management

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row a...

CVE-2026-53514: Improper Authentication

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation,...

CVE-2026-53513: Improper Input Validation

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: tru...

CVE-2026-53512: Improper Authentication

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refreshtoken grant authenticates only possession of the bound refreshToken row and matching clientid, without verifying the...

CVE-2026-45337: Improper Authorization

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny...

CVE-2026-56353: Improper Authentication

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...

CVE-2026-15720

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service...

CVE-2026-15720

Open5GS up to version 2.7.7 is affected by a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler, which may cause subscriber-wide denial of service. The CVE entry consolidates this as CVE-2026-15720. The connected sources (NVD/NVD CVE records) confirm the vulnera...

CVE-2026-15720 Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service...

CVE-2026-48978

A flaw was found in oras-go. The auth.Client in oras-go does not properly validate the scheme or host of the realm URL provided in a registry's WWW-Authenticate: Bearer challenge. A remote attacker, operating a malicious registry or performing a man-in-the-middle attack, could exploit this to...

Malicious Package

Overview @emcd-vue/auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Exploit for CVE-2023-38646

cd /metabase-poc cat README.md -p 4444 -P 8000 -u http://loc...

MAL-2026-10518 Malicious code in chai-as-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12dffbf180eff9ea18e21c9fc8c514912e95e40b3439fc43c3e3124b7ed189a3 lib/initializeCaller.js contains a self-executing IIFE that POSTs the entire process.env object to a hardcoded remote endpoint and then executes the...

Malicious Package

Overview @idms-corp/auth-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EulerOS 2.0 SP10 : cups (EulerOS-SA-2026-2643)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a...

app-tools-zxw (>=2.1.0, <=2.2.4), svc-order-zxw (>=0.0.1, <=2.3.20) +1 more potentially affected by unknown CVE via app-store-server-library (1.9.0)

app-store-server-library PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on app-store-server-library and may be impacted: - app-tools-zxw =2.1.0, =0.0.1, =3.3.2, =3.3.9 Source cves: unknown CVE Source advisory:...

app-tools-zxw (>=2.1.0, <=2.2.4), svc-order-zxw (>=0.0.1, <=2.3.20) +1 more potentially affected by unknown CVE via app-store-server-library (1.9.0)

app-store-server-library PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on app-store-server-library and may be impacted: - app-tools-zxw =2.1.0, =0.0.1, =3.3.2, =3.3.9 Source cves: unknown CVE Source advisory: GHSA-8F6J-263M-G72X...

app-tools-zxw (>=2.1.0, <=2.2.4), svc-order-zxw (>=0.0.1, <=2.3.20) +1 more potentially affected by unknown CVE via app-store-server-library (1.9.0)

app-store-server-library PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on app-store-server-library and may be impacted: - app-tools-zxw =2.1.0, =0.0.1, =3.3.2, =3.3.9 Source cves: unknown CVE Source advisory: OSV:GHSA-8F6J-263M-G72X...

MAL-2026-10506 Malicious code in node-fsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a0392a3ddea9b6099e8501fdb827f586a410323cecea214aa50fc1be42183b The package tarball ships archive-sender.js, which archives the host path /root/.codex, splits the tar into 200MB chunks, reconstructs an npm registr...