Security advisories

high2026-07-07

CVE-2026-53553-Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

zhenorzz/goploy · GHSA-4g5x-hcwm-82jw

critical2026-07-07

CVE-2026-53552-Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

zhenorzz/goploy · GHSA-26rh-24rg-j3vv

medium2026-07-07

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path

homeassistant-ai/ha-mcp · GHSA-q855-8rh5-jfgq

low2026-07-07

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

plabayo/rama · GHSA-cwv4-h3j5-w3cf

medium2026-07-07

CVE-2026-53533-aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

cole/aiosmtplib · GHSA-v3q9-hj7j-63hq

medium2026-07-07

CVE-2026-53487-Kite has an authenticated cluster RBAC bypass in /api/v1/overview

kite-org/kite · GHSA-gvhc-wv3v-7pf8

low2026-07-07

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

web-auth/webauthn-framework · GHSA-gq4g-fpc9-vjfq

medium2026-07-07

CVE-2026-53531-ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)

erweixin/ratex · GHSA-4w5h-hx6r-28q7

high2026-07-07

CVE-2026-53530-ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

erweixin/ratex · GHSA-4hgp-59h5-gvrj

critical2026-07-07

CVE-2026-59707- LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

mudler/localai · GHSA-8c5q-hx4g-qq23

critical2026-07-07

CVE-2026-58473-Cognee allows non-superusers to overwrite global LLM configuration

topoteretes/cognee · GHSA-49f7-whx5-4256

high2026-07-07

@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

better-auth/better-auth · GHSA-j8v8-g9cx-5qf4

low2026-07-07

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

better-auth/better-auth · GHSA-2vg6-77g8-24mp

high2026-07-07

CVE-2026-53518-@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

better-auth/better-auth · GHSA-7w99-5wm4-3g79

critical2026-07-07

CVE-2026-53513-@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

better-auth/better-auth · GHSA-5rr4-8452-hf4v

high2026-07-07

CVE-2026-53517-Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

better-auth/better-auth · GHSA-392p-2q2v-4372

high2026-07-07

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

better-auth/better-auth · GHSA-9h47-pqcx-hjr4

high2026-07-07

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

better-auth/better-auth · GHSA-86j7-9j95-vpqj

high2026-07-07

CVE-2026-53516-Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email

better-auth/better-auth · GHSA-g38m-r43w-p2q7

high2026-07-07

CVE-2026-53514-Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

better-auth/better-auth · GHSA-fmh4-wcc4-5jm3