atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2024-0727 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2024-0727 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2024-0727 via cryptography (1.3.4)

cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2024-0727 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2024-0727 Source advisory: OSV:PYSEC-2026-1285...

hass-auth-synology (>=0.4.13, <=0.4.28), homeassistant-stubs (2022.12.9) potentially affected by CVE-2023-50715 via homeassistant (2022.12.9)

homeassistant PYPI version 2022.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - hass-auth-synology =0.4.13, =0.4.28 - homeassistant-stubs 2022.12.9 Source cves: CVE-2023-50715 Source advisory: OSV:PYSEC-2026-14...

CVE-2026-11610

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...

PT-2026-60913

Impact WebauthnSimpleFakeCredentialGenerator is the library-provided default implementation of the FakeCredentialGenerator interface. It returns a stable list of decoy PublicKeyCredentialDescriptor objects for a given username so that an assertion request for an unknown user looks the same as a...

PT-2026-60908

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

PT-2026-67316

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The oidcProvider and mcp plugins contain insecure cryptographic defaults. The discovery document advertises the none algorithm in id token signing alg values supported and resource signing alg...

PT-2026-67313

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.13 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.3 Description The deprecated oidc-provider plugin and the mcp plugin fail to validate the scheme of redirect uris during OAuth client registration. An...

PT-2026-56299

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Better Auth versions 1.6.14 and later Description An issue exists in the organization plugin where the acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations endpoints do not sufficientl...

PT-2026-60909

Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...

PT-2026-60915

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

PT-2026-67314

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 @better-auth/scim versions prior to 1.6.11 Description When secondaryStorage is configured and storeSessionInDatabase is set to false, certain user-deletion processes fail to remove cached sessions. This...

PT-2026-56300

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Description Better Auth contains a pre-account hijacking flaw where the OAuth callback auto-link gate in the handleOAuthUserInfo function allows implicit account linking if the OAuth provider asserts email...

PT-2026-56298

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 0.1.0 through 1.6.10 @better-auth/sso versions 1.7.0-beta.x Description An SSRF flaw exists in the provider registration flow where OpenID Connect OIDC endpoint URLs are accepted without proper validation. When...

PT-2026-60914

Am I affected? Users are affected if all of these hold: - They install and register the @better-auth/scim plugin plugins: scim. - They create SCIM providers without an organizationId, that is, non-organization "personal" providers. Organization-scoped providers are not affected because they enfor...

PT-2026-56297

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The legacy oidcProvider and mcp plugins expose an OAuth 2.0 token endpoint that fails to authenticate confidential clients during the refresh token grant. The system authenticates requests based...

CVE-2026-54763

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which...

CVE-2026-54763 Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which...