Search Vulnerabilities

DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX

BOGUS configured primary hostname accepted for XFR in auth/rpz zones

Cross-zone wildcard cache poisoning via RRSIG.labels manipulation

Paymenter doesn't reset email verification status after email change

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `Subje...

Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas

Quicly is vulnerable to stateless reset injection

AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data

Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email

Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook

sigstore-js: Insufficient Verification of Data Authenticity

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections