Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,644All CVEsplus 19,141 rejected
- 674Last 24 hours2,957 in the last 7 days
- 17,129Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 19 | 7 | 1 | 0 | 36 | 40 |
| 2025 | 1 | 0 | 1 | 1 | 0 | 3 | 4 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121802 | @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a…better-auth · Better Auth | Critical9.1 |
| CVE-2026-114607 | better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-auth · better-auth | Critical9.1 |
| CVE-2026-110864 | Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxybetter-auth · better-auth | Critical9.1 |
| CVE-2026-110863 | Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providersbetter-auth · sso | High8.6 |
| CVE-2026-110862 | Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Linkbetter-auth · better-auth | Critical9.3 |
| CVE-2026-110861 | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Conditionbetter-auth · drizzle-adapter | Medium6.3 |
| CVE-2026-109346 | better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /devicebetter-auth · better-auth | High8.5 |
| CVE-2026-80192 | better-auth SSO before 1.6.27 Domain Ownership Authentication Bypassbetter-auth · sso | High8.6 |
| CVE-2025-71401 | better-auth before 1.4.2 basePath Modification DoSbetter-auth · better-auth | Critical9.3 |
| CVE-2025-71400 | better-auth passkey before 1.4.0 IDOR via delete-passkeybetter-auth · passkey | High7.1 |
| CVE-2025-71399 | Better Auth before 1.4.5 Path Normalization Bypass via rou3better-auth · better-auth | High8.8 |
| CVE-2026-67336 | better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProviderbetter-auth · better-auth | Critical9.4 |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uribetter-auth · better-auth | Medium5.1 |
| CVE-2026-67329 | @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscriptionbetter-auth · stripe | High7.1 |
| CVE-2026-67334 | better-auth Stale Sessions Persist After User Deletionbetter-auth · better-auth | Medium5.1 |
| CVE-2025-71403 | better-auth before 1.1.20 Open Redirect via trustedOrigins Bypassbetter-auth · better-auth | High7.1 |
| CVE-2026-67332 | @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypassbetter-auth · oauth-provider | Medium5.3 |
| CVE-2026-67337 | better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCachebetter-auth · better-auth | High7.1 |
| CVE-2026-67328 | @better-auth/sso before 1.6.21 Account Takeover via SSObetter-auth · sso | High8.6 |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameterbetter-auth · better-auth | Medium5.1 |
| CVE-2026-67327 | better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTPbetter-auth · better-auth | High8.7 |
| CVE-2026-67331 | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypassbetter-auth · scim | High8.7 |
| CVE-2026-67335 | better-auth before 1.6.2 OAuth State Validation Bypassbetter-auth · better-auth | Medium6.0 |
| CVE-2026-67330 | better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collisionbetter-auth · scim | Critical9.4 |
| CVE-2025-71402 | better-auth before 1.4.0 Session Revocation via Forged Cookiebetter-auth · better-auth | Low2.0 |
| CVE-2026-53517 | Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forkingbetter-auth · better-auth | High8.1 |
| CVE-2026-45337 | Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingbetter-auth · better-auth | High7.6 |
| CVE-2026-53514 | Better Auth: Unauthorized invitation acceptance via unverified email match in organization pluginbetter-auth · better-auth | High7.7 |
| CVE-2026-53515 | Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/ssobetter-auth · better-auth | High7.1 |
| CVE-2026-53512 | Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsbetter-auth · better-auth | Critical9.1 |
| CVE-2026-53518 | Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemptionbetter-auth · better-auth | High7.6 |
| CVE-2026-53513 | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registrationbetter-auth · better-auth | Critical9.6 |
| CVE-2026-53516 | Better Auth: Account takeover via OAuth auto-link to unverified pre-registered emailbetter-auth · better-auth | High8.3 |
| CVE-2026-15527 | better-auth better-icons scan_project_icons/sync_icon path traversalbetter-auth · better-icons | Medium4.8 |
| CVE-2026-45364 | Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationbetter-auth · better-auth | High7.3 |
| CVE-2026-41427 | Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clientsbetter-auth · better-auth | High7.1 |
| CVE-2025-61928 | Better Auth: Unauthenticated API key creation through api-key pluginbetter-auth · better-auth | Critical9.3 |
| CVE-2025-53535 | Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routesbetter-auth · better-auth | Low2.1 |
| CVE-2025-27143 | Beter Auth has an Open Redirect via Scheme-Less Callback Parameterbetter-auth · better-auth | Medium6.9 |
| CVE-2024-56734 | Better Auth has an Open Redirect Vulnerability in Verify Email Endpointbetter-auth · better-auth | High7.9 |