Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-67333

Publication date:

01/08/2026

better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin (which wraps the same provider). An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment&#39;s consent page navigates the browser to the returned redirectURI (e.g. assigning it to window.location.href), the attacker&#39;s JavaScript executes in the authorization-server origin, exposing the victim&#39;s session and enabling account takeover.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

CVE-2026-67338

Publication date:

01/08/2026

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

CVE-2026-67335

Publication date:

01/08/2026

better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE. Attackers can forge the state parameter and supply an attacker-controlled authorization code to create authenticated sessions bound to the attacker&#39;s external identity or persistently link attacker accounts to victim profiles.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

CVE-2026-67331

Publication date:

01/08/2026

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users&#39; providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Severity CVSS v4.0: HIGH

Last modification:

03/08/2026

CVE-2026-67327

Publication date:

01/08/2026

better-auth versions >= 1.1.3 and = 1.7.0-beta.0 and

Severity CVSS v4.0: HIGH

Last modification:

03/08/2026

CVE-2026-67329

Publication date:

01/08/2026

@better-auth/stripe versions >= 1.4.11 and = 1.7.0-beta.0 and

Severity CVSS v4.0: HIGH

Last modification:

03/08/2026

CVE-2026-67332

Publication date:

01/08/2026

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never covered, bypassing intended authorization boundaries.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

CVE-2026-67328

Publication date:

01/08/2026

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.

Severity CVSS v4.0: HIGH

Last modification:

03/08/2026

CVE-2026-67330

Publication date:

01/08/2026

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through = 1.7.0-beta.0 through

Severity CVSS v4.0: CRITICAL

Last modification:

03/08/2026

CVE-2026-67326

Publication date:

01/08/2026

GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.

Severity CVSS v4.0: HIGH

Last modification:

05/08/2026

CVE-2026-67321

Publication date:

01/08/2026

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in &#39;{}&#39;. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

CVE-2026-67319

Publication date:

01/08/2026

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process&#39;s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

Severity CVSS v4.0: MEDIUM

Last modification:

03/08/2026

Subscribe to Vulnerabilities