Lucene search
+L

381944 matches found

NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67336

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...

9.4CVSS0.00159EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•15 views

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

5.1CVSS0.00199EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•13 views

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

8.7CVSS0.00231EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

7.3CVSS0.00191EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•13 views

CVE-2026-67328

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflect...

8.6CVSS0.00278EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•10 views

CVE-2026-67330

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

9.9CVSS0.00352EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•13 views

CVE-2026-67332

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

6.4CVSS0.00162EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•15 views

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

7.1CVSS0.00196EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•14 views

CVE-2026-67331

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

8.7CVSS0.0024EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67322

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...

8.7CVSS0.00266EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•13 views

CVE-2026-67324

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

9.8CVSS0.00379EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•9 views

CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

6.3CVSS0.00258EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

8.3CVSS0.00304EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:17 p.m.•13 views

CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

6.9CVSS0.00291EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•11 views

CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

8.6CVSS0.01016EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•11 views

CVE-2026-67325

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous...

8.8CVSS0.01483EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•10 views

CVE-2026-67315

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local...

6.9CVSS0.00291EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

6.3CVSS0.00258EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•14 views

CVE-2026-67313

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger...

6.3CVSS0.00338EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•8 views

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

6.3CVSS0.00356EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•12 views

CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

6.3CVSS0.00359EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•10 views

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

6.3CVSS0.00365EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•20 views

CVE-2026-67312

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. When an application passes attacker-controlled FormData field names...

6.3CVSS0.00338EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•9 views

CVE-2026-67311

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

8.2CVSS0.00256EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•10 views

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

9.3CVSS0.00451EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•11 views

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

5.4CVSS0.00277EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:17 p.m.•10 views

CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

9.4CVSS0.00489EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•9 views

CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...

7.8CVSS0.00492EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/01 1:17 p.m.•11 views

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

5.4CVSS0.00182EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:17 p.m.•9 views

CVE-2026-67307

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

7CVSS0.00169EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-67304

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer...

8.7CVSS0.00354EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•10 views

CVE-2026-67300

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...

8.7CVSS0.00329EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

8.7CVSS0.00339EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•13 views

CVE-2026-67298

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

8.7CVSS0.00381EPSS
SaveExploits0References5
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-67303

FreeRDP before 3.29.0 contains a reachable assertion WINPRASSERTOutputBufferLength == BytesReturned in serialprocessirpdevicecontrol in channels/serial/client/serialmain.c. When serial device redirection is enabled and a server-controlled IRPMJDEVICECONTROL request specifies an unsupported IOCTL...

5.3CVSS0.00248EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

5.3CVSS0.00316EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/01 1:16 p.m.•11 views

CVE-2026-67299

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

8.7CVSS0.00329EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•12 views

CVE-2026-67292

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport libfreerdp/core/gateway/websocket.c. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious...

9.3CVSS0.00264EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

9.3CVSS0.00166EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•12 views

CVE-2026-67295

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted...

6.3CVSS0.00245EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•10 views

CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory...

8.7CVSS0.00343EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:16 p.m.•14 views

CVE-2026-67291

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a heap out-of-bounds read in updateprocessglyphfragments/glyphcachefragmentput in libfreerdp/cache/glyph.c. When handling a GLYPHFRAGMENTADD update, the code reads a one-byte server-controlled declared fragment size but does not verify it...

8.7CVSS0.00339EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•12 views

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

9.3CVSS0.00271EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•12 views

CVE-2026-67297

FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering th...

8.7CVSS0.00343EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/01 1:16 p.m.•9 views

CVE-2026-66402

FreeRDP before 3.29.0 affected versions = 3.28.0 contains multiple TLS certificate identity validation weaknesses in tlsverifycertificate, tlsmatchhostname, and x509utilsgetdnsnames. Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware...

9.8CVSS0.0029EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•12 views

CVE-2026-2411

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

6.5CVSS0.00122EPSS
SaveExploits1References2
NVD
NVD
•added 2026/08/01 1:16 p.m.•11 views

CVE-2026-67288

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache...

8.7CVSS0.0035EPSS
SaveExploits0References5
NVD
NVD
•added 2026/08/01 1:16 p.m.•10 views

CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera...

2.4CVSS0.00151EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•10 views

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

8.7CVSS0.00432EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/01 1:16 p.m.•11 views

CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

9.8CVSS0.0038EPSS
SaveExploits0References3
Total number of security vulnerabilities381944