CVE-2026-13725

creationtimestamp| type| source ---|---|--- 2026-08-01 15:30:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzrytq4ov24 2026-08-01 15:31:06+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzrz752bw2g...

CVE-2026-14822

creationtimestamp| type| source ---|---|--- 2026-08-01 15:03:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzqhriqji2l 2026-08-01 15:03:36+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzqi27enn2p...

CVE-2026-14840

creationtimestamp| type| source ---|---|--- 2026-08-01 15:00:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzqdcjv4k24 2026-08-01 15:01:38+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzqejuqb52u 2026-08-01 15:23:57+00:00| seen|...

CVE-2026-15262

creationtimestamp| type| source ---|---|--- 2026-08-01 14:36:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzoxgorwc2v 2026-08-01 14:36:46+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzoy2lsvc2p 2026-08-01 15:07:22+00:00| seen|...

CVE-2026-67342

creationtimestamp| type| source ---|---|--- 2026-08-01 14:01:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jcvjw5wuz2ydv 2026-08-01 15:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzqcxjacm2g 2026-08-01 20:22:04+00:00| seen|...

CVE-2026-67341

creationtimestamp| type| source ---|---|--- 2026-08-01 13:49:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4jpcl4yqppusi 2026-08-01 15:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzqcr5vi22b 2026-08-01 20:20:06+00:00| seen|...

CVE-2026-67337

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

UBUNTU-CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67337 better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

CVE-2026-67337

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

CVE-2026-67337

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

CVE-2026-67318 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318

CVE-2026-67318 affects axios versions 1.13.0 through 1.17.x (Node.js HTTP adapter). The root cause is that the Node.js HTTP/2 request API does not honor maxBodyLength and axios’s byte-counting stream wrapper is gated on maxRedirects === 0, allowing an attacker-controlled stream to cause outbound ...

EUVD-2026-51826

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

CVE-2026-67318 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

EUVD-2026-51824

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...