CVE Vulnerability Database
Search and browse 381,177 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-67342 | CRITICAL | 9.8 | 0.3% | Aug 1, 2026 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P... |
| CVE-2026-67341 | CRITICAL | 9.8 | 0.3% | Aug 1, 2026 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with... |
| CVE-2026-67340 | CRITICAL | 9.8 | 0.5% | Aug 1, 2026 | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b... |
| CVE-2026-67339 | MEDIUM | 6.9 | 0.2% | Aug 1, 2026 | guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cUR... |
| CVE-2026-67338 | MEDIUM | 6.1 | 0.2% | Aug 1, 2026 | JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to vali... |
| CVE-2026-67337 | HIGH | 7.1 | 0.3% | Aug 1, 2026 | better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is e... |
| CVE-2026-67336 | CRITICAL | 9.4 | 0.2% | Aug 1, 2026 | better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that adve... |
| CVE-2026-67335 | MEDIUM | 6 | 0.2% | Aug 1, 2026 | better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-... |
| CVE-2026-67334 | MEDIUM | 5.1 | 0.2% | Aug 1, 2026 | better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endp... |
| CVE-2026-67333 | HIGH | 7.2 | 0.2% | Aug 1, 2026 | better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi... |
| CVE-2026-67332 | MEDIUM | 6.4 | 0.2% | Aug 1, 2026 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing... |
| CVE-2026-67331 | HIGH | 8.7 | 0.2% | Aug 1, 2026 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator b... |
| CVE-2026-67330 | CRITICAL | 9.9 | 0.4% | Aug 1, 2026 | @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.... |
| CVE-2026-67329 | HIGH | 7.1 | 0.2% | Aug 1, 2026 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization b... |
| CVE-2026-67328 | HIGH | 8.6 | 0.3% | Aug 1, 2026 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling ... |
| CVE-2026-67327 | HIGH | 8.7 | 0.2% | Aug 1, 2026 | better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable... |
| CVE-2026-67326 | HIGH | 7.3 | 0.2% | Aug 1, 2026 | GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attac... |
| CVE-2026-67325 | HIGH | 8.8 | 1.5% | Aug 1, 2026 | GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option p... |
| CVE-2026-67324 | CRITICAL | 9.8 | 0.4% | Aug 1, 2026 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>... |
| CVE-2026-67323 | HIGH | 8.6 | 1.0% | Aug 1, 2026 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and g... |
| CVE-2026-67322 | HIGH | 8.7 | 0.3% | Aug 1, 2026 | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied rem... |
| CVE-2026-67321 | MEDIUM | 6.9 | 0.3% | Aug 1, 2026 | axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js w... |
| CVE-2026-67320 | HIGH | 8.3 | 0.3% | Aug 1, 2026 | axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard... |
| CVE-2026-67319 | MEDIUM | 6.3 | 0.3% | Aug 1, 2026 | axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the... |
| CVE-2026-67318 | MEDIUM | 6.3 | 0.4% | Aug 1, 2026 | axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bo... |