CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 2)
Page 2 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55431 | High | 7.7 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` o… |
CVE-2026-14632 | Medium | 4.3 | 2026-07-04 | A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function… |
CVE-2026-25779 | Medium | 6.1 | 2026-07-03 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. |
CVE-2026-41106 | Critical | 9.3 | 2026-07-02 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-55660 | | 2026-07-01 | Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-… | |
CVE-2026-58520 | Medium | 6.1 | 2026-07-01 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. T… |
CVE-2026-58450 | Medium | 4.3 | 2026-06-30 | Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticate… |
CVE-2026-10562 | | 2026-06-30 | An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web int… | |
CVE-2026-40080 | Medium | 6.1 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather… |
CVE-2026-52802 | Medium | 5.4 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters… |
CVE-2026-13163 | | 2026-06-24 | Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows re… | |
CVE-2026-54588 | Critical | 9.6 | 2026-06-23 | Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header… |
CVE-2026-47377 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path e… | |
CVE-2026-53662 | Critical | 9.6 | 2026-06-23 | immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulner… |
CVE-2026-56697 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-p… |
CVE-2026-56326 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-nor… |
CVE-2026-44889 | Medium | 6.1 | 2026-06-22 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an op… |
CVE-2026-41479 | Medium | 5.4 | 2026-06-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned… |
CVE-2026-54276 | Medium | 6.1 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after… |
CVE-2026-12863 | | 2026-06-22 | An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains. | |
CVE-2026-12804 | Medium | 4.3 | 2026-06-21 | A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the library lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of… |
CVE-2026-56332 | Medium | 4.7 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external webs… |
CVE-2026-56330 | Low | 3.5 | 2026-06-20 | Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, a… |
CVE-2026-47645 | High | 8.8 | 2026-06-19 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a netwo… |
CVE-2026-12622 | Medium | 5.4 | 2026-06-19 | The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03… |
CVE-2026-48895 | High | 7.2 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redir… |
CVE-2026-44915 | Medium | 6.1 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to ph… |
CVE-2026-12049 | Medium | 4.3 | 2026-06-19 | Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter w… |
CVE-2026-55237 | High | 8.8 | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-… |
CVE-2026-20178 | Medium | 4.3 | 2026-06-17 | A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage… |
CVE-2025-32748 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2026-10839 | | 2026-06-17 | Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs gener… | |
CVE-2026-10837 | | 2026-06-17 | Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened… | |
CVE-2026-46955 | High | 7.5 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. D… |
CVE-2026-46894 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.1… |
CVE-2026-46806 | High | 8.2 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1… |
CVE-2026-46796 | High | 8.0 | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1… |
CVE-2026-35302 | High | 8.3 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1… |
CVE-2026-35259 | High | 8.8 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1… |
CVE-2026-35258 | High | 8.7 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1… |
CVE-2026-53523 | Medium | 6.8 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL… |
CVE-2026-50089 | Medium | 6.1 | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estim… |
CVE-2026-46616 | Medium | 5.4 | 2026-06-10 | Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail t… |
CVE-2026-48856 | Medium | 6.5 | 2026-06-10 | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Autho… |
CVE-2026-45566 | Medium | 6.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by r… |
CVE-2026-53440 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" security realm is safe to r… |
CVE-2026-53437 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains t… |
CVE-2026-53436 | Medium | 4.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains r… |
CVE-2026-41706 | Medium | 6.1 | 2026-06-10 | Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected… |
CVE-2026-41008 | Medium | 6.1 | 2026-06-10 | Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious… |
CVE-2026-47991 | Medium | 6.1 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability that could result in… |
CVE-2026-28301 | Medium | 4.8 | 2026-06-09 | A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website. |
CVE-2026-47347 | | 2026-06-09 | Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed… | |
CVE-2026-41844 | Medium | 4.2 | 2026-06-09 | A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a l… |
CVE-2026-11502 | Low | 3.1 | 2026-06-08 | A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system… |
CVE-2026-11477 | Medium | 4.3 | 2026-06-08 | A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-… |
CVE-2026-21826 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause… |
CVE-2026-10861 | Medium | 6.1 | 2026-06-04 | An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used… |
CVE-2026-10856 | Medium | 6.1 | 2026-06-04 | A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by brow… |
CVE-2026-43924 | | 2026-06-03 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of admini… | |
CVE-2026-41569 | Medium | 6.1 | 2026-06-02 | authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw s… |
CVE-2026-40181 | Medium | 6.1 | 2026-06-02 | React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open… |
CVE-2026-45278 | Low | 3.3 | 2026-06-01 | Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users t… |
CVE-2026-40961 | High | 7.2 | 2026-06-01 | A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from… |
CVE-2026-49380 | Low | 3.1 | 2026-05-29 | In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible |
CVE-2026-45307 | Medium | 6.1 | 2026-05-28 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate… |
CVE-2026-44681 | Medium | 6.1 | 2026-05-27 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImpli… |
CVE-2026-45335 | Medium | 5.4 | 2026-05-27 | WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-49059 | Medium | 4.7 | 2026-05-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCom… |
CVE-2026-48924 | Medium | 4.3 | 2026-05-27 | Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks. |
CVE-2026-44833 | Medium | 5.9 | 2026-05-26 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious s… |
CVE-2026-48589 | Medium | 5.4 | 2026-05-25 | Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validat… |
CVE-2026-44598 | Medium | 5.4 | 2026-05-25 | With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This i… |
CVE-2026-47070 | Medium | 6.1 | 2026-05-25 | Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackney_h3.erl passes the… |
CVE-2026-48832 | Low | 3.5 | 2026-05-24 | action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. |
CVE-2026-40295 | Medium | 6.1 | 2026-05-22 | Devise is an authentication solution for Rails based on Warden. In versions 5.0.3 and below, when the Timeoutable module is enabled in Devise, the FailureApp#r… |
CVE-2026-9245 | Medium | 5.0 | 2026-05-22 | Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to a… |
CVE-2025-26483 | Medium | 6.1 | 2026-05-22 | Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerabi… |
CVE-2026-2813 | Medium | 4.7 | 2026-05-20 | ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a speciall… |
CVE-2026-7504 | High | 8.1 | 2026-05-19 | A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirec… |
CVE-2025-65954 | Medium | 6.1 | 2026-05-18 | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint… |
CVE-2026-45037 | High | 7.1 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the oper… |
CVE-2026-42207 | Medium | 6.1 | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-44427 | | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in intern… | |
CVE-2026-44520 | Medium | 5.7 | 2026-05-14 | Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the… |
CVE-2026-45448 | Medium | 4.3 | 2026-05-14 | CWE-601 URL redirection to untrusted site ('open redirect') |
CVE-2026-44503 | | 2026-05-14 | The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensit… | |
CVE-2026-44437 | Medium | 6.1 | 2026-05-13 | The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerabi… |
CVE-2026-45055 | High | 8.1 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with… |
CVE-2026-44372 | Medium | 6.1 | 2026-05-13 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host red… |
CVE-2026-41513 | | 2026-05-12 | Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. Thi… | |
CVE-2026-42565 | Medium | 4.3 | 2026-05-11 | @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.h… |
CVE-2026-42350 | | 2026-05-08 | Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in U… | |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2026-3318 | | 2026-05-08 | Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘ret… | |
CVE-2026-43941 | Critical | 9.6 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler p… |
CVE-2026-42259 | | 2026-05-07 | Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-log… | |
CVE-2026-6795 | Critical | 9.6 | 2026-05-07 | URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Parameter Injection. This issu… |
CVE-2026-41670 | High | 8.2 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServi… |
CVE-2026-40332 | | 2026-05-06 | Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning… |