CVE-2026-14452 | | | 2026-10-16 | Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to exe… |
CVE-2026-111385 | Medium | 4.8 | 2026-10-16 | Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs f… |
CVE-2026-55840 | Medium | 5.4 | 2026-10-15 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java… |
CVE-2026-93649 | | | 2026-10-15 | In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the po… |
CVE-2026-72528 | Medium | 4.3 | 2026-10-15 | "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up b… |
CVE-2026-82402 | | | 2026-10-14 | Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect end… |
CVE-2026-107369 | Medium | 6.1 | 2026-10-13 | The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for… |
CVE-2026-83646 | Medium | 4.8 | 2026-10-13 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a ne… |
CVE-2026-83500 | Medium | 6.1 | 2026-10-13 | Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2026-103576 | Medium | 6.5 | 2026-10-13 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a… |
CVE-2026-66057 | | | 2026-10-13 | Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to… |
CVE-2026-109160 | Medium | 4.3 | 2026-10-13 | A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/… |
CVE-2026-7767 | Medium | 5.8 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain… |
CVE-2026-89122 | Medium | 6.1 | 2026-10-13 | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link th… |
CVE-2026-92116 | | | 2026-10-12 | OAuth1 callback validation vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version… |
CVE-2024-58389 | Medium | 6.1 | 2026-10-12 | HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an u… |
CVE-2026-108261 | Critical | 9.3 | 2026-10-09 | Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index… |
CVE-2026-79650 | Medium | 6.1 | 2026-10-09 | Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker… |
CVE-2026-107718 | Medium | 6.1 | 2026-10-08 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter… |
CVE-2026-101152 | High | 8.0 | 2026-10-06 | Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, caus… |
CVE-2026-101151 | Medium | 4.3 | 2026-10-06 | Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user… |
CVE-2026-106322 | Medium | 6.1 | 2026-10-06 | Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a… |
CVE-2026-105846 | Medium | 6.1 | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an atta… |
CVE-2026-80327 | | | 2026-10-06 | An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 202… |
CVE-2026-102778 | Medium | 6.1 | 2026-10-05 | Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image l… |
CVE-2026-105128 | Medium | 5.4 | 2026-10-04 | LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url para… |
CVE-2026-39600 | Medium | 4.7 | 2026-10-02 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects A… |
CVE-2026-97318 | Medium | 6.1 | 2026-10-02 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later r… |
CVE-2026-55252 | | | 2026-10-01 | OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrict… |
CVE-2026-83589 | Medium | 6.1 | 2026-10-01 | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote a… |
CVE-2026-102090 | Medium | 4.3 | 2026-09-30 | Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-co… |
CVE-2026-88791 | Low | 3.4 | 2026-09-30 | The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is… |
CVE-2026-103048 | Medium | 6.1 | 2026-09-30 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
… |
CVE-2026-53989 | Medium | 4.7 | 2026-09-29 | Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authent… |
CVE-2026-73599 | Medium | 5.4 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability… |
CVE-2026-76720 | Medium | 4.3 | 2026-09-29 | A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. |
CVE-2026-101907 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An… |
CVE-2026-101090 | Critical | 9.8 | 2026-09-27 | Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/… |
CVE-2026-97165 | | | 2026-09-27 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to… |
CVE-2026-100523 | Medium | 6.1 | 2026-09-26 | Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthentica… |
CVE-2026-97325 | Medium | 4.3 | 2026-09-24 | A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCac… |
CVE-2026-96892 | Medium | 4.3 | 2026-09-24 | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of… |
CVE-2026-96773 | Medium | 4.3 | 2026-09-24 | A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php o… |
CVE-2026-18505 | Medium | 5.4 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An una… |
CVE-2026-80444 | Medium | 5.4 | 2026-09-23 | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.
This issue affects AVESİS… |
CVE-2026-95813 | Medium | 6.1 | 2026-09-22 | e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing att… |
CVE-2026-54915 | Medium | 5.4 | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.p… |
CVE-2026-94214 | Medium | 4.3 | 2026-09-21 | A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipu… |
CVE-2026-94102 | Medium | 4.3 | 2026-09-21 | A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulati… |
CVE-2026-7527 | Medium | 4.7 | 2026-09-19 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is… |
CVE-2026-93871 | Medium | 5.4 | 2026-09-18 | Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit perm… |
CVE-2026-93869 | Medium | 6.1 | 2026-09-18 | Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression l… |
CVE-2026-77386 | Medium | 6.5 | 2026-09-18 | Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an… |
CVE-2026-77609 | Medium | 6.1 | 2026-09-18 | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `Special… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-65388 | High | 7.5 | 2026-09-16 | A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim'… |
CVE-2026-92141 | Medium | 4.3 | 2026-09-16 | Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-86823 | Medium | 5.3 | 2026-09-16 | The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthen… |
CVE-2026-92216 | Medium | 4.3 | 2026-09-16 | A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/g… |
CVE-2026-83320 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4… |
CVE-2026-83198 | Medium | 5.4 | 2026-09-15 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3… |
CVE-2026-89307 | | | 2026-09-15 | The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, e… |
CVE-2026-54724 | Medium | 6.1 | 2026-09-15 | Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauth… |
CVE-2026-91772 | Medium | 6.1 | 2026-09-15 | Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can c… |
CVE-2026-13277 | Medium | 4.7 | 2026-09-14 | IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2026-15412 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using a… |
CVE-2026-12985 | Medium | 6.8 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL compone… |
CVE-2026-73191 | Medium | 6.1 | 2026-09-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope.
When the Syncope SRA is configured for CAS authentication, the target… |
CVE-2023-24034 | Low | 3.1 | 2026-09-14 | An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect v… |
CVE-2026-80072 | Medium | 4.7 | 2026-09-13 | The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unaut… |
CVE-2026-90453 | Low | 3.5 | 2026-09-11 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… |
CVE-2026-81913 | Medium | 6.1 | 2026-09-11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain… |
CVE-2026-54072 | Critical | 9.3 | 2026-09-11 | Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_ur… |
CVE-2026-88887 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote regi… |
CVE-2026-88882 | High | 8.6 | 2026-09-10 | Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterpr… |
CVE-2026-88881 | High | 8.6 | 2026-09-10 | Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub E… |
CVE-2026-88880 | High | 8.6 | 2026-09-10 | Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-b… |
CVE-2026-8323 | Critical | 9.3 | 2026-09-10 | URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of D… |
CVE-2026-86756 | Medium | 6.1 | 2026-09-09 | Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoin… |
CVE-2026-78377 | Medium | 6.1 | 2026-09-09 | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Tr… |
CVE-2026-81741 | Medium | 4.7 | 2026-09-09 | The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirm… |
CVE-2026-28631 | High | 7.8 | 2026-09-08 | In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalatio… |
CVE-2026-28630 | Low | 3.3 | 2026-09-08 | In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure… |
CVE-2026-28626 | High | 7.3 | 2026-09-08 | In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalat… |
CVE-2026-28572 | High | 7.8 | 2026-09-08 | In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no… |
CVE-2026-84389 | Low | 3.1 | 2026-09-08 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker… |
CVE-2026-86351 | Medium | 6.1 | 2026-09-07 | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because… |
CVE-2026-86256 | Medium | 5.4 | 2026-09-06 | wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enter… |
CVE-2026-86205 | Medium | 5.4 | 2026-09-06 | h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Refer… |
CVE-2026-81423 | Medium | 4.3 | 2026-09-05 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attacker… |
CVE-2026-85676 | Medium | 4.3 | 2026-09-04 | Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforc… |
CVE-2026-53728 | High | 7.1 | 2026-09-03 | Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/exter… |
CVE-2026-49456 | Low | 3.1 | 2026-09-03 | Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/d… |
CVE-2026-84662 | Medium | 4.3 | 2026-09-02 | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an a… |
CVE-2026-53683 | Medium | 4.3 | 2026-09-02 | reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionall… |
CVE-2026-73734 | Medium | 5.4 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an… |
CVE-2026-82731 | | | 2026-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redir… |
CVE-2026-78079 | | | 2026-08-31 | Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64… |
CVE-2026-40465 | Medium | 5.3 | 2026-08-31 | NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. |
CVE-2026-82467 | Medium | 4.7 | 2026-08-29 | Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_t… |