56810 matches found
Missing Authorization
Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Missing Authorization in the acceptInvitation function of the organization plugin when the system relies solely on an unverified email-string equality check ...
GHSA-PW9M-5JXM-XR6H Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
Am I affected? Users are affected if all of the following are true: - Their application uses better-auth and has enabled at least one of: oidcProvider imported from better-auth/plugins/oidc-provider, or mcp imported from better-auth/plugins/mcp. - Their application has at least one confidential...
NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...
CVE-2026-59708 Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings,...
GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file
Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...
GO-2026-5908 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder
Coder vulnerable to OIDC account takeover via email-based user matching and emailverified bypass in github.com/coder/coder...
CVE-2026-53878
creationtimestamp| type| source ---|---|--- 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:03:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2y6fbxvq23...
MINI-8RQG-VHVG-WQ2V
Bulletin has no description...
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access during the May 2025...
CVE-2026-53483
creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...
389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...
MAL-2026-9954 Malicious code in zzjinavcssvn (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9547 Malicious code in xwandservmtg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9103 Malicious code in vand3flmy1778552525 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9091 Malicious code in v4zzgbqvirfx (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8938 Malicious code in swkefepbkjgqj (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8213 Malicious code in oaigx7857181 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7956 Malicious code in lbrssypnbowmaf (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-48891
creationtimestamp| type| source ---|---|--- 2026-07-07 11:48:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jwvygdg2y 2026-07-07 12:11:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2l747p7b2y...
PYSEC-2026-2006 Defining resource name as integer may give unintended access in vantage6
Impact Malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for...