6227 matches found
CVE-2026-18952
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
CVE-2026-18952
Technical details are not publicly available in the provided documents. Monitor for updates from NVD and CVE records.
CVE-2026-18952 Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
CVE-2026-18952: Server-Side Request Forgery (SSRF)
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
CVE-2026-64941
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-64941
The CVE describes an Open Redirect in Phoenix.LiveView.validate_local_url!/2 where ASCII tab, LF or CR are not rejected. This allows a crafted :to value to bypass path-only validation and be resolved as a scheme-relative URL (e.g., //example.com) when using redirect/2 and related navigation funct...
EUVD-2026-55263
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
CVE-2026-64941
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...
EEF-CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private...
CVE-2026-14860 Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...
Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...
CVE-2026-50630
A flaw was found in apache-cxf. This vulnerability, known as a Carriage Return Line Feed CRLF injection, allows an attacker to manipulate HTTP response headers. By injecting special characters into the 'realm' parameter of the WWW-Authenticate header, an attacker can add arbitrary HTTP headers or...
CVE-2026-54199
Tobit Laboratories AG TeamDavid’s Webbox is vulnerable to HTTP header injection via the request body in the link-storing function (//ServerClient_celink.htm), which is appended to the redirect target in the 302 response. Inserting a line feed can propagate into the redirect URL, enabling control ...
Antiphishing v31101732395
DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...
CVE-2026-66709
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
CVE-2026-65560
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...