CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS

better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...

CVE-2026-15262

creationtimestamp| type| source ---|---|--- 2026-08-01 14:36:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzoxgorwc2v 2026-08-01 14:36:46+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzoy2lsvc2p 2026-08-01 15:07:22+00:00| seen|...

GHSA-HR7P-WG7R-HG9M

creationtimestamp| type| source ---|---|--- 2026-07-30 23:32:08+00:00| seen| https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3 2026-07-31 00:01:11+00:00| seen| https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

EUVD-2025-210536

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2025-67404

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

EUVD-2026-50306

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

ShinyHunters Claims Ernst & Young (EY) Data Breach, Threatens July 31 Leak

EY confirmed the theft of client tax documents from its third-party support platform. ShinyHunters claims responsibility and is threatening to publish the data...

CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-64372

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in OSC evaluation pcccpufreqdoosc calls acpievaluateobject twice for the two-phase OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged...

UBUNTU-CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

EUVD-2026-48864

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...