CVE-2025-71403

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403

The CVE-2025-71403 entry concerns better-auth versions prior to 1.1.20, where a bypass in trustedOrigins validation logic affects absolute URLs and wildcard domains. This enables an attacker to craft malicious callbackURL parameters that bypass origin checks and trigger open redirects, potentiall...

EUVD-2025-210582

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

EUVD-2026-51842

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

Directory Traversal

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Directory Traversal via percent-encoded parent-directory segments or encoded path separators in template URLs. An attacker can execute unsafe template features from a repository...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

EUVD-2026-51625

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999

Copier (library and CLI for rendering project templates) is affected from version 9.5.0 through 9.16.0. Percent-encoded parent-directory segments or encoded path separators in a template URL could match a configured trusted repository prefix before HTTP server or Git transport decoding, enabling ...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-14919

The ShopMonitor.io WordPress plugin, in versions before 1.2.0 , is vulnerable to an unauthenticated administrator account takeover . The root cause is an improperly restricted email-rerouting test mode that relies on a trusted-source check satisfiable via client-supplied request headers . This fl...

EUVD-2026-51440

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

SUSE CVE-2026-10720

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate such as enrolled cluster members or join token can manipulate files in an imported remote cluster within the...

PT-2026-66849

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

PT-2026-66706

Name of the Vulnerable Software and Affected Versions ShopMonitor.io versions prior to 1.2.0 Description The plugin fails to properly restrict its email-rerouting test mode, relying on a trusted-source check that can be bypassed using client-supplied request headers. This allows unauthenticated...