Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.2 HIGH
CVE-2026-67333 — better-auth before 1.6.13 Stored XSS via javascript redirect_uri

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin…

Remote | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-67332 — @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an O…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.3 HIGH
CVE-2026-67331 — better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attac…

Remote | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
9.9 CRITICAL
CVE-2026-67330 — better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject pr…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
7.1 HIGH
CVE-2026-67329 — @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription

@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organi…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.1 HIGH
CVE-2026-67328 — @better-auth/sso before 1.6.21 Account Takeover via SSO

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domai…

Remote | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.3 HIGH
CVE-2026-67327 — better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign…

Remote | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
7.0 HIGH
CVE-2026-67326 — GitPython before 3.1.50 Newline Injection via config_writer section

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject…

| Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.8 HIGH
CVE-2026-67325 — GitPython before 3.1.51 Command Injection via option prefix abbreviation

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by us…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
9.8 CRITICAL
CVE-2026-67324 — GitPython 3.1.50 Authentication Bypass via Joined Short Options

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes att…

Remote | Misconfiguration
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.4 HIGH
CVE-2026-67323 — GitPython before 3.1.51 Command Injection via unguarded Git options

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-…

| Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
7.5 HIGH
CVE-2026-67322 — GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls…

Remote | Information Disclosure
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.9 MEDIUM
CVE-2026-67321 — axios before 0.33.0 Denial of Service via maxDepth bypass

axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed …

Remote | Denial of Service
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.3 HIGH
CVE-2026-67320 — axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but reque…

Remote | Misconfiguration
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.3 MEDIUM
CVE-2026-67319 — axios before 0.33.0 Prototype Pollution via nested option objects

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another com…

Remote | Misconfiguration
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.3 MEDIUM
CVE-2026-67318 — axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request …

Remote | Misconfiguration
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.3 MEDIUM
CVE-2026-67317 — axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-l…

Remote | Denial of Service
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.3 MEDIUM
CVE-2026-67316 — axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the body…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.9 MEDIUM
CVE-2026-67315 — axios 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs t…

Remote | Misconfiguration
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.3 MEDIUM
CVE-2026-67314 — axios before 1.18.0 Prototype Pollution via auth subfields

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is alrea…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
Showing 20 of 9318 Results