{"total":5,"summary":{"firstDisclosureYear":2018,"severityCounts":[{"level":"Critical","count":1},{"level":"High","count":2},{"level":"Medium","count":2}],"reach":[{"disclosureId":"CVE-2026-110879","count":25000000,"atLeast":false,"display":"25M","label":"downloads a month of Jackson in 2020, the second most used Java library","source":{"label":"Indeed Engineering","url":"https://engineering.indeedblog.com/blog/2020/09/jackson-more-than-json-for-java/"}},{"disclosureId":"CVE-2026-104721","count":4000000000,"atLeast":true,"display":"4B+","label":"downloads a year of Logback and SLF4J together","source":{"label":"QOS.ch","url":"https://github.com/sponsors/qos-ch"}},{"disclosureId":"GHSA-r4xp-prcw-77qf","count":12783122,"atLeast":false,"display":"12.8M","label":"npm downloads of Better Auth in one week","source":{"label":"npm download counts","url":"https://api.npmjs.org/downloads/range/2026-09-29:2026-10-05/better-auth"}}],"reachAsOf":"2026-10-21"},"vulnerabilities":[{"id":"CVE-2026-110879","project":"jackson-databind","weaknesses":[{"cwe":"CWE-502","name":"Deserialization of Untrusted Data","url":"https://cwe.mitre.org/data/definitions/502.html"}],"impact":"An attacker who could send polymorphic JSON to an affected application could make Jackson create objects of classes of their choosing, without authentication or any action by a user. With Spring on the classpath and attacker-controlled XML the application could load, the demonstrated path ran commands under the application account; with the JDK alone, it created or truncated files, used up file descriptors and issued URL requests.","details":"Jackson checked the outer class named in a class-name type ID but accepted attacker-selected classes inside its generic arguments and array element types, including classes it rejected as direct type IDs. This bypassed the generic-argument validation added for CVE-2026-54512, and the releases that fixed that CVE still accepted this path. Affected configurations include class-name polymorphism with a default Jackson 3 mapper and default typing in Jackson 2 and 3.","releases":[{"affected":{"from":"2.10.0","to":"2.18.11","platforms":[]},"fixed":{"version":"2.18.12","url":"https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.18.12/release-notes/VERSION-2.x"},"versions":"Affected 2.10.0 to 2.18.11 · Fixed 2.18.12"},{"affected":{"from":"2.19.0","to":"2.21.7","platforms":[]},"fixed":{"version":"2.21.8","url":"https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.21.8/release-notes/VERSION-2.x"},"versions":"Affected 2.19.0 to 2.21.7 · Fixed 2.21.8"},{"affected":{"from":"2.22.0","to":"2.22.3","platforms":[]},"fixed":{"version":"2.22.4","url":"https://github.com/FasterXML/jackson-databind/blob/jackson-databind-2.22.4/release-notes/VERSION-2.x"},"versions":"Affected 2.22.0 to 2.22.3 · Fixed 2.22.4"},{"affected":{"from":"3.0.0","to":"3.1.7","platforms":[]},"fixed":{"version":"3.1.8","url":"https://github.com/FasterXML/jackson-databind/blob/jackson-databind-3.1.8/release-notes/VERSION"},"versions":"Affected 3.0.0 to 3.1.7 · Fixed 3.1.8"},{"affected":{"from":"3.2.0","to":"3.2.3","platforms":[]},"fixed":{"version":"3.2.4","url":"https://github.com/FasterXML/jackson-databind/blob/jackson-databind-3.2.4/release-notes/VERSION"},"versions":"Affected 3.2.0 to 3.2.3 · Fixed 3.2.4"}],"reportedDate":null,"publishedDate":"2026-10-20","severity":{"level":"Critical","score":9.8,"cvssVersion":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","assignedBy":"the GitHub advisory","calculatorUrl":"https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"roles":[{"role":"Found","commitUrl":null},{"role":"Reported","commitUrl":null},{"role":"Regression test","commitUrl":"https://github.com/FasterXML/jackson-databind/commit/f8f66a6c1febd1cf7ed29ab5e3d7abfa03f7a98f"},{"role":"Fix","commitUrl":"https://github.com/FasterXML/jackson-databind/commit/f8f66a6c1febd1cf7ed29ab5e3d7abfa03f7a98f"}],"openSource":true,"recordUrl":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph","links":[{"label":"GitHub advisory","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph"},{"label":"Fix pull request","url":"https://github.com/FasterXML/jackson-databind/pull/6287"},{"label":"Follow-up fix pull request","url":"https://github.com/FasterXML/jackson-databind/pull/6289"}]},{"id":"CVE-2026-104721","project":"Logback Classic","weaknesses":[{"cwe":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","url":"https://cwe.mitre.org/data/definitions/22.html"}],"impact":"An attacker could make an application write to any reachable file it had permission to change, including files outside its log directory. The attacker could replace Logback's active configuration, expose future logs, disable or falsify audit records, redirect logs, and create, overwrite, or truncate other writable files.","details":"Some applications use Logback to create separate log files for different users, customers, or requests. If the application copied attacker-controlled data into the value used for the file name, an attacker could use a variable that became a slash after Logback checked it and escape the intended directory. Replacing the logging configuration also required automatic reloading, overwrite mode, control of the logged message, and a path that could reach the configuration file.","releases":[{"affected":{"from":"0.9.14","to":"1.6.4","platforms":[]},"fixed":{"version":"1.6.5","url":"https://logback.qos.ch/news.html#1.6.5"},"versions":"Affected 0.9.14 to 1.6.4 · Fixed 1.6.5"}],"reportedDate":null,"publishedDate":"2026-10-02","severity":{"level":"Medium","score":6.3,"cvssVersion":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green","assignedBy":"the CVE record","calculatorUrl":"https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green"},"roles":[{"role":"Found","commitUrl":null},{"role":"Reported","commitUrl":null}],"openSource":true,"recordUrl":"https://www.cve.org/cverecord?id=CVE-2026-104721","links":[{"label":"CVE record","url":"https://www.cve.org/cverecord?id=CVE-2026-104721"},{"label":"logback 1.6.5 release note","url":"https://logback.qos.ch/news.html#1.6.5"}]},{"id":"GHSA-r4xp-prcw-77qf","project":"Better Auth","weaknesses":[{"cwe":"CWE-287","name":"Improper Authentication","url":"https://cwe.mitre.org/data/definitions/287.html"},{"cwe":"CWE-345","name":"Insufficient Verification of Data Authenticity","url":"https://cwe.mitre.org/data/definitions/345.html"}],"impact":"An attacker who knew only a user's verified email address could sign in as that user without knowing their password or requiring any action from the victim. The attacker could access private data, change the account, and add another sign-in method.","details":"This affected applications using the OAuth Proxy plugin with sign-in data stored in cookies. By default, the plugin protected profiles with the application's main Better Auth secret, which also protected the sign-in data. An attacker could make Better Auth encrypt a forged profile and then accept it as real. Another demonstrated variant worked without the victim's email if the attacker knew an existing provider account identifier.","releases":[{"affected":{"from":"1.5.0-beta.12","to":"1.7.6","platforms":[]},"fixed":{"version":"1.7.7","url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.7"},"versions":"Affected 1.5.0-beta.12 to 1.7.6 · Fixed 1.7.7"}],"reportedDate":null,"publishedDate":"2026-09-30","severity":{"level":"High","score":7.4,"cvssVersion":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","assignedBy":"the GitHub advisory","calculatorUrl":"https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"roles":[{"role":"Found","commitUrl":null},{"role":"Reported","commitUrl":null}],"openSource":true,"recordUrl":"https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf","links":[{"label":"GitHub advisory","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-r4xp-prcw-77qf"},{"label":"Fix pull request","url":"https://github.com/better-auth/better-auth/pull/11494"}]},{"id":"CVE-2021-36460","project":"VeryFitPro","weaknesses":[{"cwe":"CWE-836","name":"Use of Password Hash Instead of Password for Authentication","url":"https://cwe.mitre.org/data/definitions/836.html"}],"impact":"Anyone who obtained a user's password hash could take over the account without knowing the password.","details":"The app hashes the password on the device with SHA-1 and sends that hash as the credential for login, registration and password changes, so the hash the server stores works like the password itself.","releases":[{"affected":{"from":null,"to":"3.3.7","platforms":["Android","iOS"]},"fixed":null,"versions":"Affected 3.3.7 and earlier (Android, iOS) · Fixed: no fix"}],"reportedDate":"2021-06-25","publishedDate":"2022-04-25","severity":{"level":"High","score":7.8,"cvssVersion":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","assignedBy":"NVD","calculatorUrl":"https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"roles":[{"role":"Found","commitUrl":null},{"role":"Reported","commitUrl":null}],"openSource":false,"recordUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-36460","links":[{"label":"NVD record","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36460"},{"label":"Write-up","url":"https://github.com/martinfrancois/CVE-2021-36460"}]},{"id":"CVE-2018-1000529","project":"Grails Fields plugin","weaknesses":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","variant":"stored","url":"https://cwe.mitre.org/data/definitions/79.html"}],"impact":"An attacker who could store a value in a Grails application could run script in the browser of anyone who viewed that value.","details":"The plugin's display tag rendered bean property values without HTML encoding. Grails scaffolding uses the plugin, so scaffolded applications were affected.","releases":[{"affected":{"from":null,"to":"2.2.7","platforms":[]},"fixed":{"version":"2.2.8","url":"https://github.com/grails-fields-plugin/grails-fields/commit/a67c96219b3dd31f61a1c0b595a7439e63eee277"},"versions":"Affected 2.2.7 and earlier · Fixed 2.2.8"}],"reportedDate":"2018-05-22","publishedDate":"2018-06-26","severity":{"level":"Medium","score":6.1,"cvssVersion":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","assignedBy":"NVD","calculatorUrl":"https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"roles":[{"role":"Found","commitUrl":null},{"role":"Reported","commitUrl":null}],"openSource":true,"recordUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000529","links":[{"label":"NVD record","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000529"},{"label":"Write-up","url":"https://github.com/martinfrancois/CVE-2018-1000529"}]}]}