PT-2026-64366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the pwrseq debugfs seq next function. The function declares a next variable with freeput device, which triggers put device when the variable goes out of...

CVE-2026-14603: Improper Access Control

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database...

PT-2026-64303

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

UBUNTU-CVE-2026-39155

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can create an overly broad authenticated denial interval, allowing downstream validating resolvers using aggressive negative caching to...

CVE-2025-71389

Cal.com (calcom/cal.diy) versions before 5.9.9 are vulnerable to unauthenticated remote code execution via Next.js React Server Components (RSC) request handling that deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server to execute arbitrary code d...

Not Failing Securely ('Failing Open')

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by unknown CVE via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...

Improper Check for Unusual or Exceptional Conditions

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending...

GHSA-XMF8-CVQR-RFGJ Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken helper next-auth/jwt and @auth/core/jwt can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken URL-decodes the bearer value before validating it, and malformed percent-encoding causes the...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +51 more potentially affected by CVE-2026-73420 via next-auth (>=4.10.3, <=4.24.13)

next-auth NPM version =4.10.3, =1.9.0, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =0.0.0-experimental-20231123101256, =4.4.0 and more Source cves: CVE-2026-73420 Source advisory: OSV:GHSA-7RQJ-J65F-68WH...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +51 more potentially affected by unknown CVE via next-auth (>=4.10.3, <=4.24.13)

next-auth NPM version =4.10.3, =1.9.0, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =0.0.0-experimental-20231123101256, =4.4.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306876...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306841...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73419 via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

Improper Verification of Source of a Communication Channel

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim's...

CVE-2026-52686

The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth...

PT-2026-71311

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32 Description The getToken function in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when processing...

CVE-2026-39155

Knot DNS versions before 3.4.10 and 3.5.x before 3.5.4 are impacted by a vulnerability in the mod-onlinesign component. The root cause is an incorrect computation of the next NSEC owner name , which creates an overly broad authenticated denial interval. This flaw allows downstream validating reso...