GHSA-H3RM-78G3-J7CP @better-auth/stripe: cross-organization billing tampering in organization subscription actions

Am I affected? You are affected if all of these are true: - You use @better-auth/stripe from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on subscription.enabled:...

CVE-2026-56082

Capgo Cap-go/capgo before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.recordbuildtime, which is granted to the anon role and callable with only the public Supabase publishable sbpublishable anon key. An unauthenticated attacker...