oauth

• CVE-2026-41003 - Spring Security generated form XSS 2026-06-15
• CVE-2025-6514 - mcp-remote OAuth command injection 2026-06-11
• CVE-2026-41574 - Nhost OAuth email verification bypass 2026-05-02
• CVE-2026-42560 - go-pkgz/auth Patreon identity collision 2026-05-02