https://securelayer7.net/lab/better-auth-scim-provider-account-takeover-missing-owner-binding SecureLayer7 en 2026-07-07T21:07:58.122Z @better-auth/scim: SCIM Provider Account Takeover via Missing Owner Binding Security Research https://securelayer7.net/lab/better-auth-stored-xss-javascript-redirect-uri-oidc-provider SecureLayer7 en 2026-07-07T21:28:53.367Z better-auth Stored XSS via javascript: redirect_uri in oidc-provider and mcp Plugins Security Research https://securelayer7.net/lab/cve-2026-49464-nl-portal-taak-idor-submittaakv2 SecureLayer7 en 2026-07-08T21:28:40.118Z CVE-2026-49464: NL Portal Taak IDOR Allows Takeover of Any User's Open Task CVE Advisory https://securelayer7.net/lab/cve-2026-49471-serena-agent-unauthenticated-dashboard-dns-rebinding-rce SecureLayer7 en 2026-07-08T21:28:07.593Z CVE-2026-49471: serena-agent Unauthenticated Flask Dashboard Enables DNS Rebinding to RCE CVE Advisory https://securelayer7.net/lab/cve-2026-49476-soupsieve-memory-exhaustion-selector-list SecureLayer7 en 2026-07-09T14:08:28.197Z CVE-2026-49476: soupsieve Memory Exhaustion via Unbounded Selector List CVE Advisory https://securelayer7.net/lab/cve-2026-49477-soupsieve-redos-selector-parser SecureLayer7 en 2026-07-09T14:07:58.260Z CVE-2026-49477: soupsieve Regular Expression Denial of Service (ReDoS) CVE Advisory https://securelayer7.net/lab/cve-2026-49485-hl7-fhir-dstu2-redos-fhirpath-matches SecureLayer7 en 2026-07-09T13:49:29.535Z CVE-2026-49485: org.hl7.fhir.dstu2 FHIRPathEngine ReDoS via Unprotected matches() CVE Advisory https://securelayer7.net/lab/cve-2026-49825-lxml-html-clean-xlink-href-xss SecureLayer7 en 2026-07-08T20:48:00.787Z CVE-2026-49825: lxml_html_clean javascript: XSS via xlink:href CVE Advisory https://securelayer7.net/lab/cve-2026-49832-dspace-velocity-template-injection-rce-ldn SecureLayer7 en 2026-07-08T20:28:41.209Z CVE-2026-49832: DSpace Remote Code Execution via Velocity Template Injection in LDN CVE Advisory https://securelayer7.net/lab/cve-2026-50197-skipper-opa-body-bypass-chunked-encoding SecureLayer7 en 2026-07-08T20:29:50.643Z CVE-2026-50197: Skipper opaAuthorizeRequestWithBody OPA Policy Bypass via Chunked Encoding CVE Advisory https://securelayer7.net/lab/cve-2026-50553-note-mark-path-traversal-slug-migrate-export SecureLayer7 en 2026-07-09T13:50:17.845Z CVE-2026-50553: Note Mark Path Traversal via Unsanitized Book/Note Slug in Migrate Export CVE Advisory https://securelayer7.net/lab/cve-2026-52831-nuclio-cron-trigger-command-injection-rce SecureLayer7 en 2026-07-08T20:29:21.288Z CVE-2026-52831: Nuclio Cron Trigger OS Command Injection (Persistent RCE) CVE Advisory https://securelayer7.net/lab/cve-2026-53513-better-auth-sso-ssrf-oidc-endpoints SecureLayer7 en 2026-07-07T21:09:12.087Z CVE-2026-53513: @better-auth/sso SSRF via Unvalidated OIDC Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-53514-better-auth-organization-invitation-takeover-unverified-email SecureLayer7 en 2026-07-07T21:30:00.879Z CVE-2026-53514: better-auth Organization Invitation Takeover via Unverified Email Pre-Registration CVE Advisory https://securelayer7.net/lab/cve-2026-53516-better-auth-oauth-auto-link-account-takeover SecureLayer7 en 2026-07-07T21:29:27.273Z CVE-2026-53516: better-auth OAuth Auto-Link Account Takeover via Unverified Email CVE Advisory https://securelayer7.net/lab/cve-2026-53517-better-auth-oauth-provider-refresh-token-race-condition SecureLayer7 en 2026-07-07T21:09:50.634Z CVE-2026-53517: @better-auth/oauth-provider Refresh Token Family Fork via Race Condition CVE Advisory https://securelayer7.net/lab/cve-2026-53518-better-auth-oauth-provider-authorization-code-race-condition SecureLayer7 en 2026-07-07T21:08:35.275Z CVE-2026-53518: @better-auth/oauth-provider Authorization Code Race Condition Allows Duplicate Token Issuance CVE Advisory https://securelayer7.net/lab/cve-2026-53530-ratex-parser-verb-utf8-panic-dos SecureLayer7 en 2026-07-07T23:49:14.771Z CVE-2026-53530: ratex-parser Process Abort via UTF-8 Multibyte Delimiter in \verb CVE Advisory https://securelayer7.net/lab/cve-2026-53552-goploy-cross-namespace-idor-rce-project-id SecureLayer7 en 2026-07-07T23:48:43.254Z CVE-2026-53552: Goploy Cross-Namespace IDOR and RCE via Body-Controlled Project ID CVE Advisory https://securelayer7.net/lab/cve-2026-53553-goploy-path-traversal-file-read SecureLayer7 en 2026-07-07T23:47:58.046Z CVE-2026-53553: Goploy Arbitrary File Read via Path Traversal in /deploy/fileDiff CVE Advisory https://securelayer7.net/lab/cve-2026-53649-joro-unauthenticated-cross-origin-plugin-upload-rce SecureLayer7 en 2026-07-08T20:28:04.075Z CVE-2026-53649: Joro Unauthenticated Cross-Origin Plugin Upload RCE CVE Advisory https://securelayer7.net/lab/cve-2026-53727-css-parser-ssrf-local-file-disclosure-import SecureLayer7 en 2026-07-09T13:48:54.144Z CVE-2026-53727: css_parser SSRF and Local File Disclosure via @import CVE Advisory https://securelayer7.net/lab/cve-2026-56382-craftcms-fieldscontroller-yii2-event-injection-rce SecureLayer7 en 2026-07-09T13:48:02.176Z CVE-2026-56382: Craft CMS RCE via Yii2 Event Handler Injection in FieldsController Security Research https://securelayer7.net/lab/micronaut-http-client-infinite-redirect-loop-dos SecureLayer7 en 2026-07-09T14:09:29.703Z micronaut-http-client Infinite Redirect Loop Denial of Service Security Research https://securelayer7.net/lab/phantom-audio-arbitrary-file-write-mcp-path-traversal SecureLayer7 en 2026-07-09T14:09:00.429Z phantom-audio: Arbitrary File Write and Decode-Bomb DoS via Unconfined MCP Tool Paths Security Research