CVE-2025-15628

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release

The 1.4.3 release of the RHTAS CLIs. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS CLI Stack images for RHTAS 1.4.3...

CVE-2025-15627

The CVE-2025-15627 issue involves hard-coded cryptographic keys in the Omada adoption protocol used by TP-Link/Omada controllers and managed devices. The underlying flaw enables impersonation of trusted controllers or devices and could expose sensitive adoption-related communications during devic...

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...

CVE-2026-20469

In trustedmem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533...

CVE-2026-20469

CVE-2026-20469 affects the trusted_mem path where improper input validation can lead to local privilege escalation if an attacker already has System privileges. Exploitation requires user interaction per the description. Patch AUTO00834868 (MSV-6533) is referenced as the remedy.

CVE-2025-71403

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403

The CVE-2025-71403 entry concerns better-auth versions prior to 1.1.20, where a bypass in trustedOrigins validation logic affects absolute URLs and wildcard domains. This enables an attacker to craft malicious callbackURL parameters that bypass origin checks and trigger open redirects, potentiall...

CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

EUVD-2025-210582

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

EUVD-2026-51842

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999

Copier (library and CLI for rendering project templates) is affected from version 9.5.0 through 9.16.0. Percent-encoded parent-directory segments or encoded path separators in a template URL could match a configured trusted repository prefix before HTTP server or Git transport decoding, enabling ...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-14919

The vulnerability CVE-2026-14919 affects the ShopMonitor.io WordPress plugin prior to 1.2.0. The plugin’s email-rerouting test mode is inadequately restricted by a trusted-source check that can be satisfied with client-supplied request headers, enabling unauthenticated attackers to redirect outgo...