漏洞公告

Cognee allows non-superusers to overwrite global LLM configuration

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

netfoil: Attacker controlled data written to logs

netfoil has a resource leak in LRU cache

netfoil has a domain name filter bypass via multiple questions

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality

Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

Open WebUI vulnerable to Stored XSS via iFrame in citations model

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Open WebUI allows limited stored XSS vila uploaded html file

Django: GDALRaster may over-read heap memory when constructed from bytes