CVE-2026-102090 | Medium | 4.3 | 2026-09-30 | Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-co… |
CVE-2026-88791 | Low | 3.4 | 2026-09-30 | The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is… |
CVE-2026-103048 | | | 2026-09-30 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
… |
CVE-2026-53989 | Medium | 4.7 | 2026-09-29 | Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authent… |
CVE-2026-73599 | Medium | 5.4 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability… |
CVE-2026-76720 | Medium | 4.3 | 2026-09-29 | A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. |
CVE-2026-101907 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An… |
CVE-2026-101090 | Critical | 9.8 | 2026-09-27 | Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/… |
CVE-2026-97165 | | | 2026-09-27 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to… |
CVE-2026-100523 | Medium | 6.1 | 2026-09-26 | Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthentica… |
CVE-2026-97325 | Medium | 4.3 | 2026-09-24 | A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCac… |
CVE-2026-96892 | Medium | 4.3 | 2026-09-24 | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of… |
CVE-2026-96773 | Medium | 4.3 | 2026-09-24 | A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php o… |
CVE-2026-18505 | Medium | 5.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An una… |
CVE-2026-80444 | Medium | 5.4 | 2026-09-23 | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.
This issue affects AVESİS… |
CVE-2026-95813 | Medium | 6.1 | 2026-09-22 | e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing att… |
CVE-2026-54915 | Medium | 5.4 | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.p… |
CVE-2026-94214 | Medium | 4.3 | 2026-09-21 | A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Lo… |
CVE-2026-94102 | Medium | 4.3 | 2026-09-21 | A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulati… |
CVE-2026-7527 | Medium | 4.7 | 2026-09-19 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is… |
CVE-2026-93871 | Medium | 5.4 | 2026-09-18 | Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit perm… |
CVE-2026-93869 | Medium | 6.1 | 2026-09-18 | Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression l… |
CVE-2026-77386 | Medium | 6.5 | 2026-09-18 | Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an… |
CVE-2026-77609 | Medium | 6.1 | 2026-09-18 | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-65388 | High | 7.5 | 2026-09-16 | A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim'… |
CVE-2026-92141 | Medium | 4.3 | 2026-09-16 | Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-86823 | Medium | 5.3 | 2026-09-16 | The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthen… |
CVE-2026-92216 | Medium | 4.3 | 2026-09-16 | A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/g… |
CVE-2026-83320 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4… |
CVE-2026-83198 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-89307 | | | 2026-09-15 | The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, e… |
CVE-2026-54724 | Medium | 6.1 | 2026-09-15 | Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauth… |
CVE-2026-91772 | Medium | 6.1 | 2026-09-15 | Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can c… |
CVE-2026-13277 | Medium | 4.7 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2026-15412 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using a… |
CVE-2026-12985 | Medium | 6.8 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL compone… |
CVE-2026-73191 | Medium | 6.1 | 2026-09-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope.
When the Syncope SRA is configured for CAS authentication, the target… |
CVE-2023-24034 | Low | 3.1 | 2026-09-14 | An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect v… |
CVE-2026-80072 | Medium | 4.7 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unaut… |
CVE-2026-90453 | | | 2026-09-11 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… |
CVE-2026-81913 | Medium | 6.1 | 2026-09-11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
CVE-2026-54072 | Critical | 9.3 | 2026-09-11 | Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_ur… |
CVE-2026-88887 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote regi… |
CVE-2026-88882 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterpr… |
CVE-2026-88881 | High | 8.6 | 2026-09-10 | Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub E… |
CVE-2026-88880 | High | 8.6 | 2026-09-10 | Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-b… |
CVE-2026-8323 | Critical | 9.3 | 2026-09-10 | URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of D… |
CVE-2026-86756 | Medium | 6.1 | 2026-09-09 | Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoin… |
CVE-2026-78377 | Medium | 6.1 | 2026-09-09 | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Tr… |
CVE-2026-81741 | Medium | 4.7 | 2026-09-09 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirm… |
CVE-2026-28631 | High | 7.8 | 2026-09-08 | In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalatio… |
CVE-2026-28630 | Low | 3.3 | 2026-09-08 | In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure… |
CVE-2026-28626 | High | 7.3 | 2026-09-08 | In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalat… |
CVE-2026-28572 | High | 7.8 | 2026-09-08 | In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no… |
CVE-2026-84389 | Low | 3.1 | 2026-09-08 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker… |
CVE-2026-86351 | Medium | 6.1 | 2026-09-07 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because… |
CVE-2026-86256 | Medium | 5.4 | 2026-09-06 | wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enter… |
CVE-2026-86205 | Medium | 5.4 | 2026-09-06 | h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Refer… |
CVE-2026-81423 | Medium | 4.3 | 2026-09-05 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attacker… |
CVE-2026-85676 | Medium | 4.3 | 2026-09-04 | Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforc… |
CVE-2026-53728 | High | 7.1 | 2026-09-03 | Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/exter… |
CVE-2026-49456 | Low | 3.1 | 2026-09-03 | Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/d… |
CVE-2026-84662 | Medium | 4.3 | 2026-09-02 | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an a… |
CVE-2026-53683 | Medium | 4.3 | 2026-09-02 | reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionall… |
CVE-2026-73734 | Medium | 5.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an… |
CVE-2026-82731 | | | 2026-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redir… |
CVE-2026-78079 | | | 2026-08-31 | Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64… |
CVE-2026-40465 | Medium | 5.3 | 2026-08-31 | NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. |
CVE-2026-82467 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_t… |
CVE-2026-82464 | Medium | 6.1 | 2026-08-29 | pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matchin… |
CVE-2026-81342 | Medium | 4.7 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it… |
CVE-2026-82274 | Medium | 4.7 | 2026-08-28 | Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query para… |
CVE-2026-55834 | Medium | 4.3 | 2026-08-28 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts… |
CVE-2026-59355 | Medium | 6.1 | 2026-08-27 | In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An at… |
CVE-2026-47887 | Medium | 6.1 | 2026-08-27 | A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open… |
CVE-2026-47883 | Medium | 6.1 | 2026-08-27 | UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Sp… |
CVE-2026-47848 | Medium | 6.1 | 2026-08-26 | In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this… |
CVE-2026-81036 | High | 8.1 | 2026-08-26 | Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crate… |
CVE-2026-81029 | High | 8.1 | 2026-08-26 | OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request para… |
CVE-2026-80200 | Medium | 4.7 | 2026-08-26 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
CVE-2026-79786 | High | 7.1 | 2026-08-25 | Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to… |
CVE-2026-79662 | High | 8.0 | 2026-08-25 | Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only… |
CVE-2026-78145 | Medium | 4.3 | 2026-08-23 | A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manip… |
CVE-2026-55185 | | | 2026-08-21 | Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go U… |
CVE-2026-67362 | | | 2026-08-21 | Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-… |
CVE-2026-77028 | | | 2026-08-21 | Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66 |
CVE-2026-53586 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-49996 | Low | 3.7 | 2026-08-20 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version… |
CVE-2026-71428 | Critical | 9.3 | 2026-08-20 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2026-54770 | Medium | 6.1 | 2026-08-20 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value fo… |
CVE-2026-75628 | Medium | 5.7 | 2026-08-20 | Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the re… |
CVE-2026-55087 | Medium | 6.1 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/expre… |
CVE-2026-53654 | | | 2026-08-19 | Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an… |
CVE-2026-75114 | | | 2026-08-19 | Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight… |
CVE-2026-70958 | Critical | 9.6 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version… |
CVE-2026-75833 | Medium | 4.2 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoCont… |
CVE-2026-49826 | | | 2026-08-14 | Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect t… |
CVE-2025-71405 | | | 2026-08-14 | chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect UR… |
CVE-2026-73563 | Medium | 4.7 | 2026-08-13 | Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document fe… |