CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 3)
Page 3 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43576 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to unt… |
CVE-2026-35253 | Medium | 4.7 | 2026-05-06 | Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily exploitable vulnera… |
CVE-2025-61669 | Medium | 6.1 | 2026-05-05 | Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficie… |
CVE-2026-42230 | Medium | 6.1 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client regi… |
CVE-2026-41226 | Medium | 4.7 | 2026-04-30 | Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the use… |
CVE-2026-42525 | Medium | 4.3 | 2026-04-29 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to per… |
CVE-2026-30346 | Medium | 4.3 | 2026-04-27 | An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted… |
CVE-2026-33102 | Critical | 9.3 | 2026-04-23 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41126 | Medium | 4.3 | 2026-04-22 | BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL."… |
CVE-2026-40905 | High | 8.1 | 2026-04-21 | LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to im… |
CVE-2026-34315 | Medium | 6.5 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0… |
CVE-2026-34284 | Medium | 6.1 | 2026-04-21 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). Supported versions that ar… |
CVE-2026-34283 | Medium | 6.1 | 2026-04-21 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2… |
CVE-2026-40299 | | 2026-04-17 | next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could… | |
CVE-2026-40255 | Medium | 6.1 | 2026-04-16 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 throu… |
CVE-2026-20060 | Medium | 4.7 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicio… |
CVE-2026-40096 | Medium | 5.4 | 2026-04-15 | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared albu… |
CVE-2026-21741 | Low | 2.4 | 2026-04-14 | An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all ver… |
CVE-2026-34257 | Medium | 6.1 | 2026-04-14 | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a vi… |
CVE-2026-6203 | Medium | 6.1 | 2026-04-13 | The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient valid… |
CVE-2026-39940 | | 2026-04-13 | ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, wh… | |
CVE-2026-32932 | Medium | 4.7 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker… |
CVE-2025-66447 | Unrated | | 2026-04-10 | Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /l… |
CVE-2026-22560 | Medium | 5.3 | 2026-04-10 | An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML… |
CVE-2026-25854 | Medium | 6.1 | 2026-04-09 | Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tom… |
CVE-2026-39985 | Medium | 4.3 | 2026-04-09 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-40037 | Medium | 6.5 | 2026-04-08 | OpenClaw before 2026.3.31 (patched in 2026.4.8) contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be rese… |
CVE-2026-39484 | Medium | 4.7 | 2026-04-08 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghos… |
CVE-2026-23818 | High | 8.8 | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse… |
CVE-2026-35475 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist che… |
CVE-2026-35474 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from… |
CVE-2026-35473 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-35411 | Medium | 4.3 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect… |
CVE-2026-35410 | Medium | 6.1 | 2026-04-06 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirecti… |
CVE-2026-35404 | Medium | 4.7 | 2026-04-06 | Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is pas… |
CVE-2026-35472 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-35398 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-35396 | Medium | 6.1 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2025-61166 | Medium | 6.1 | 2026-04-06 | An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL. |
CVE-2026-33510 | High | 8.8 | 2026-04-06 | Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The… |
CVE-2018-25245 | High | 7.5 | 2026-04-04 | 7 Tik 1.0.1.0 contains a denial of service vulnerability that allows attackers to crash the application by submitting excessively long input strings to the sea… |
CVE-2026-33709 | Medium | 6.1 | 2026-04-03 | JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHu… |
CVE-2026-5467 | Medium | 4.3 | 2026-04-03 | A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. S… |
CVE-2026-34931 | Critical | 9.6 | 2026-04-02 | hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. Wi… |
CVE-2026-34847 | Medium | 4.7 | 2026-04-02 | hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redire… |
CVE-2026-34083 | Medium | 6.1 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in it… |
CVE-2026-3872 | High | 7.3 | 2026-04-02 | A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform R… |
CVE-2026-2475 | Low | 3.1 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 thr… |
CVE-2024-58342 | Medium | 6.3 | 2026-04-01 | XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect t… |
CVE-2026-34442 | Medium | 5.4 | 2026-03-31 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (htt… |
CVE-2026-32113 | Medium | 6.1 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-4799 | Medium | 4.3 | 2026-03-31 | In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL. |
CVE-2026-33885 | Medium | 6.1 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect valida… |
CVE-2026-33868 | Medium | 4.3 | 2026-03-27 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulne… |
CVE-2026-33506 | High | 8.8 | 2026-03-26 | Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Connect. Versions prior to 26.2.0 contain a DOM-based… |
CVE-2026-33397 | Medium | 6.1 | 2026-03-26 | The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3… |
CVE-2026-1166 | Medium | 4.3 | 2026-03-25 | Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8. |
CVE-2026-33296 | Medium | 6.1 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplie… |
CVE-2026-29105 | Medium | 5.4 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, SuiteCRM contains… |
CVE-2026-20994 | Medium | 6.1 | 2026-03-16 | URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token. |
CVE-2026-32235 | Medium | 5.9 | 2026-03-12 | Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backstage/plugin-auth-backend is vulnerable… |
CVE-2026-2376 | Medium | 4.9 | 2026-03-12 | A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal or restricted systems by providing mali… |
CVE-2026-3824 | Medium | 6.1 | 2026-03-11 | IFTOP developed by WellChoose has an Open redirect vulnerability, allowing authenticated remote attackers to craft a URL that tricks users into visiting malici… |
CVE-2026-23817 | Medium | 6.5 | 2026-03-11 | A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. |
CVE-2026-21295 | Low | 3.1 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Ope… |
CVE-2026-31819 | Medium | 6.1 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction() and StorageBa… |
CVE-2026-28512 | High | 7.1 | 2026-03-10 | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to before 2.4.0, a flaw in callback URL valida… |
CVE-2025-70032 | Medium | 6.1 | 2026-03-09 | An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. |
CVE-2025-70037 | Medium | 6.1 | 2026-03-09 | An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223. This allows attackers to obtain sensitive inf… |
CVE-2026-29067 | High | 8.1 | 2026-03-07 | ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanis… |
CVE-2026-28106 | Medium | 4.7 | 2026-03-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a… |
CVE-2026-28681 | High | 8.1 | 2026-03-06 | Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and… |
CVE-2026-28413 | Medium | 5.3 | 2026-03-05 | Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example m… |
CVE-2026-27982 | Medium | 6.1 | 2026-03-05 | An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may… |
CVE-2026-25477 | Medium | 6.1 | 2026-03-02 | AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redire… |
CVE-2026-28415 | Medium | 4.3 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accep… |
CVE-2026-27738 | | 2026-02-25 | The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the internal URL processing logic in version… | |
CVE-2026-27736 | Medium | 6.1 | 2026-02-25 | BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, u… |
CVE-2026-28194 | Medium | 4.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow |
CVE-2026-24847 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Eye Exam form module allow… |
CVE-2026-3049 | Medium | 4.3 | 2026-02-24 | A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of th… |
CVE-2026-25649 | High | 7.3 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users can steal OAuth 2.0 authorizat… |
CVE-2026-1369 | Medium | 4.3 | 2026-02-22 | The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue |
CVE-2026-27191 | Medium | 6.1 | 2026-02-21 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.39 and below the redirect query paramete… |
CVE-2025-69725 | Medium | 4.7 | 2026-02-19 | An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using… |
CVE-2025-71244 | Medium | 6.1 | 2026-02-19 | SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a vi… |
CVE-2026-25392 | Medium | 4.7 | 2026-02-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with ne… |
CVE-2026-2709 | Low | 3.5 | 2026-02-19 | A flaw has been found in busy up to 2.5.5. The affected element is an unknown function of the file source-code/busy-master/src/server/app.js of the component C… |
CVE-2026-0573 | Critical | 9.0 | 2026-02-18 | An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens… |
CVE-2026-1296 | Medium | 6.1 | 2026-02-18 | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficien… |
CVE-2026-1277 | Medium | 4.7 | 2026-02-18 | The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redire… |
CVE-2025-27900 | Medium | 6.8 | 2026-02-17 | IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a v… |
CVE-2025-65717 | Medium | 4.3 | 2026-02-16 | An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page. |
CVE-2025-2418 | Medium | 4.3 | 2026-02-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows Phishing. This issue affects Web… |
CVE-2026-26003 | Medium | 5.4 | 2026-02-10 | FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authent… |
CVE-2026-25956 | Medium | 6.1 | 2026-02-10 | Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could l… |
CVE-2026-24328 | Medium | 6.1 | 2026-02-10 | SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to atta… |
CVE-2026-24323 | Medium | 6.1 | 2026-02-10 | The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. W… |
CVE-2026-0508 | High | 7.3 | 2026-02-10 | The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Up… |
CVE-2026-0484 | Medium | 6.5 | 2026-02-10 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code… |