Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:58:41 +0000 EUVD-2026-343721 https://cve.radiocsirt.org/vuln/euvd-2026-343721 EUVD-2026-343721 https://cve.radiocsirt.org/vuln/euvd-2026-343721 fkie_cve-2025-71404 https://cve.radiocsirt.org/vuln/fkie_cve-2025-71404 <p>better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the &#39;error&#39; URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user&#39;s browser. The issue is fixed in version 1.1.16.</p> <p>better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the &#39;error&#39; URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user&#39;s browser. The issue is fixed in version 1.1.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-71404 GHSA-ch2q-47vm-cxgf https://cve.radiocsirt.org/vuln/ghsa-ch2q-47vm-cxgf <p>better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the &#39;error&#39; URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user&#39;s browser. The issue is fixed in version 1.1.16.</p> <p>better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the &#39;error&#39; URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user&#39;s browser. The issue is fixed in version 1.1.16.</p> https://cve.radiocsirt.org/vuln/ghsa-ch2q-47vm-cxgf