{"vulnerability": "cve-2026-5351", "sightings": [{"uuid": "922520ce-540d-4102-8e4e-1acf32bcfed5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53510", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxtx6byfe2g", "content": "\ud83d\udfe0 CVE-2026-53510 - High (8.1)\n\nSavon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-53510/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-31T21:00:30.339094Z"}, {"uuid": "8751de50-c448-4d34-a691-8f8375daaa99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53510", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/clluyssqd2hdq", "content": "CVE-2026-53510 - Savon::Model evaluates WSDL operation names as Ruby source\nCVE ID : CVE-2026-53510\n \n Published : July 31, 2026, 8:16 p.m. | 1\u00a0hour, 25\u00a0minutes ago\n \n Description : Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates...", "creation_timestamp": "2026-07-31T21:49:24.338600Z"}, {"uuid": "e03b6b21-96a8-4d34-bda8-273c5d30768d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53510", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrxy7saggs2u", "content": "Ruby SOAP\u30af\u30e9\u30a4\u30a2\u30f3\u30c8Savon 0.9.8\uff5e2.17.2\u306fWSDL\u64cd\u4f5c\u540d\u3092\u60aa\u7528\u3055\u308c\u308b\u8106\u5f31\u6027\u3092\u6301\u3064\u3002\u3053\u308c\u306b\u3088\u308a\u653b\u6483\u8005\u306f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d7\u30ed\u30bb\u30b9\u5185\u3067Ruby\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002\nCVE-2026-53510 CVSS 8.1 | HIGH", "creation_timestamp": "2026-07-31T22:16:50.624344Z"}, {"uuid": "26c41cef-a53e-44ab-a0c4-dc4d37c7a603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53510", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-53510", "content": "", "creation_timestamp": "2026-08-01T00:15:18.153323Z"}, {"uuid": "0802b86f-7544-4e6f-9d36-a513a2d1c2ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53510", "type": "seen", "source": "https://bsky.app/profile/connorshea.bsky.social/post/3mo2egnpf5s2u", "content": "I got my first CVE ever, in a Ruby gem! :) CVE-2026-53510\n\nI found it using Claude (Opus 4.6 IIRC) and Scrutineer.\n\ngithub.com/savonrb/savo...", "creation_timestamp": "2026-06-11T23:20:00.205115Z"}, {"uuid": "d7315d11-aa87-41c0-94d6-76546d8e6341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-53519", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116739855858486390", "content": "\ud83d\udee1\ufe0f CVE-2026-53519: CRITICAL path traversal in Nezha Monitoring (<2.0.13). Unauthenticated attackers can read arbitrary files via crafted URLs. Patch to 2.0.13+ ASAP! https://radar.offseq.com/threat/cve-2026-53519-cwe-22-improper-limitation-of-a-pat-3dc4f02c #OffSeq #CVE202653519 #infosec #vuln", "creation_timestamp": "2026-06-13T00:00:43.222613Z"}, {"uuid": "e8382400-be50-4bd1-899e-03fbe2ed7bea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53519", "type": "published-proof-of-concept", "source": "https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh", "content": "", "creation_timestamp": "2026-06-27T00:35:24.688398Z"}, {"uuid": "f07142ca-c1af-4b13-8bed-96199058bf71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53512", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq3ifp5g5c2q", "content": "CVE-2026-53512 - better-auth\nSome Better Auth plugins don't verify client secrets for refresh tokens, which could allow an attacker to access sensitive data. If you use Better Auth with the oidc-provider or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#betterauth #npm #CVE #infosec", "creation_timestamp": "2026-07-07T20:54:04.425045Z"}, {"uuid": "d2d60bde-c697-4efe-a9ea-1431a68e5384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53513", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq3lgb7llz25", "content": "CVE-2026-53513 - sso\nIf you're using an outdated version of the @better-auth/sso plugin, an attacker can access your server by tricking your system into making unauthorized requests. This can happen even\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sso #betterauth #npm #CVE #infosec", "creation_timestamp": "2026-07-07T21:48:04.619993Z"}, {"uuid": "12f1bc61-7865-41d0-91cf-64bcf28ec9fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53518", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq3lgclew62b", "content": "CVE-2026-53518 - oauth-provider\nThe Better Auth OAuth Provider, used in some applications, can issue duplicate access tokens if two requests for the same authorization code are made at the same\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oauthprovider #betterauth #npm #CVE #infosec", "creation_timestamp": "2026-07-07T21:48:06.588213Z"}, {"uuid": "f4b83df8-0ebb-4326-8176-09f130f988d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53511", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3quv37dx2k", "content": "CVE-2026-53511 - calibre: Arbitrary Code Execution in Template Formatter via Book Metadata\nCVE ID : CVE-2026-53511\n \n Published : July 7, 2026, 9:17 p.m. | 1\u00a0hour, 57\u00a0minutes ago\n \n Description : calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file...", "creation_timestamp": "2026-07-07T23:25:43.880068Z"}, {"uuid": "d80efb7e-af4a-4eef-93af-20726a16bd2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53511", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdggb7dsr2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53511 \u0432 Calibre: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0445 \u043a\u043d\u0438\u0433\n\n\n\nhttps://kripta.biz/posts/A90DDFE8-46DE-4692-95E1-A8817D9098B9", "creation_timestamp": "2026-07-11T00:39:53.811450Z"}, {"uuid": "b4f62798-2541-4002-b89d-43ceede49158", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53519", "type": "seen", "source": "https://t.me/GithubRedTeam/89007", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-53519-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tar-xz\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-15 19:47:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-53519.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:42.354413Z"}, {"uuid": "cb4559d2-4380-41e7-9a89-70afe5767982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53519", "type": "seen", "source": "https://t.me/GithubRedTeam/89007", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-53519-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tar-xz\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-15 19:47:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-53519.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:41.484080Z"}, {"uuid": "4ab670a1-d940-4fe9-b637-061989d005b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53513", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqkz3drgcq24", "content": "CVE-2026-53513 is a Better Auth SSRF flaw (CVSS 9.6) in the SSO plugin. It exposes cloud metadata and enables account takeover. Patch to 1.6.11 now.\n\n#BetterAuth #SSRF #CVE202653513 #SSO #OIDC", "creation_timestamp": "2026-07-14T01:02:27.478598Z"}, {"uuid": "cc07d667-195f-4536-b703-c02fe172e778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53519", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89007", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-53519-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tar-xz\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-15 19:47:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit for CVE-2026-53519.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:07.463654Z"}, {"uuid": "20ea28e7-6b8f-4bfa-b358-d1671d62bb69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53517", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpfvfhfhu2m", "content": "\ud83d\udfe0 CVE-2026-53517 - High (8.1)\n\nBetter Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 unti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-53517/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-15T19:02:25.619001Z"}, {"uuid": "ab338876-2982-4dce-9e83-b2518b26822a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53517", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpfzulx4e2u", "content": "CVE-2026-53517 - Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking\nCVE ID : CVE-2026-53517\n \n Published : July 15, 2026, 6:16 p.m. | 17\u00a0minutes ago\n \n Description : Better Auth is an authentication and authoriza...", "creation_timestamp": "2026-07-15T19:04:54.780862Z"}, {"uuid": "839d5008-3261-465f-844a-b47bce112e25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53516", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgag62su2u", "content": "CVE-2026-53516 - Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email\nCVE ID : CVE-2026-53516\n \n Published : July 15, 2026, 6:16 p.m. | 17\u00a0minutes ago\n \n Description : Better Auth is an authentication and authorization library for TypeScript. Pr...", "creation_timestamp": "2026-07-15T19:08:34.477805Z"}, {"uuid": "ca65fd81-afe3-445d-b83c-2d93d3dede2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53512", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqph2wla3a22", "content": "CVE-2026-53512 - Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins\nCVE ID : CVE-2026-53512\n \n Published : July 15, 2026, 6:16 p.m. | 17\u00a0minutes ago\n \n Description : Better Auth is an authentication and authorization libr...", "creation_timestamp": "2026-07-15T19:23:24.115910Z"}, {"uuid": "a6032ba0-4b37-473f-ac28-d2af79790852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53513", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpibc3wko2x", "content": "CVE-2026-53513 - Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration\nCVE ID : CVE-2026-53513\n \n Published : July 15, 2026, 6:16 p.m. | 17\u00a0minutes ago\n \n Description : Better Auth is an authentication and authorizati...", "creation_timestamp": "2026-07-15T19:44:51.166011Z"}, {"uuid": "18365c0e-c26a-4a1b-8de7-f17af81f03d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53513", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr7h4w2ibr2s", "content": "\ud83d\udccc CVE-2026-53513 - Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST ... https://www.cyberhub.blog/cves/CVE-2026-53513", "creation_timestamp": "2026-07-22T04:07:06.517637Z"}, {"uuid": "727a7d92-e22a-4381-8d2f-c87796c8a8c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53512", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mr7iskmfyt2l", "content": "\ud83d\udccc CVE-2026-53512 - Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token... https://www.cyberhub.blog/cves/CVE-2026-53512", "creation_timestamp": "2026-07-22T04:37:06.573894Z"}, {"uuid": "dcad5b44-6974-4c11-9eb4-e9476b2d470d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53517", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mragy5s6v426", "content": "\ud83d\udccc CVE-2026-53517 - Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth... https://www.cyberhub.blog/cves/CVE-2026-53517", "creation_timestamp": "2026-07-22T13:37:06.772673Z"}, {"uuid": "1f86e9ee-56b4-4fa1-b3ef-57dd3d90c837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53516", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mra4wca4cg2s", "content": "\ud83d\udccc CVE-2026-53516 - Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuth... https://www.cyberhub.blog/cves/CVE-2026-53516", "creation_timestamp": "2026-07-22T10:37:07.133436Z"}]}