CVE-2026-47347

CVE-2026-47347 affects TYPO3 CMS where GeneralUtility::sanitizeLocalUrl can be bypassed, enabling an open redirect if a URL is used after sanitization. Affected versions are older: 10.4.57, 11.0.0–11.5.50, 12.0.0–12.4.45, 13.0.0–13.4.30, and 14.0.0–14.3.2. The CVE entry notes the impact as open r...

CVE-2026-41007

creationtimestamp| type| source ---|---|--- 2026-06-09 08:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mntq6af5ab2n...

CVE-2026-46749

creationtimestamp| type| source ---|---|--- 2026-06-09 07:30:01+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-siemens-22 2026-06-09 11:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnu273c2t32n 2026-06-23 05:00:00+00:00| seen|...

CVE-2026-8499

creationtimestamp| type| source ---|---|--- 2026-06-09 07:24:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnto3pp7i72m 2026-06-11 15:16:16+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnzjfhayk42t...

CVE-2026-8904

creationtimestamp| type| source ---|---|--- 2026-06-09 07:07:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mntn5ysy4q2v 2026-06-11 20:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mo225w5h2k26...

CVE-2026-9662

creationtimestamp| type| source ---|---|--- 2026-06-09 06:06:24+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mntjfl5xe42o 2026-06-09 07:13:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mntnisftxr2v 2026-06-10 06:16:06+00:00| seen|...

CVE-2026-41854

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18...

UBUNTU-CVE-2026-41854

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18...

CVE-2026-41854

The CVE affects Spring Framework 7.0.0–7.0.7 and 6.2.0–6.2.18, where incorrect host parsing in UriComponentsBuilder may allow a server-side request forgery (SSRF) when parsing an externally provided URL string. The vulnerability is described as an SSRF condition resulting from this parsing flaw. ...

CVE-2026-8904 FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save

The FastPicker, an order picker and order management system oms for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the settingsPage function. This makes i...

CVE-2026-44746

Due to a reflected cross-site scripting XSS vulnerability in SAP NetWeaver JAVA JDBC Test Servlet, an unauthenticated attacker could craft a URL that embeds a malicious script. If a victim clicks this link, the injected input is processed during web page generation, resulting in the execution of...

CVE-2026-44757

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...

CVE-2026-44757

CVE-2026-44757 affects SAP Wily Introscope Enterprise Manager. The vulnerability is a Cross-Site Scripting (XSS) issue where an unauthenticated attacker can craft a specially crafted URL. When a victim visits the URL, injected script could execute in the user’s browser within the application cont...

CVE-2026-44746 Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)

Due to a reflected cross-site scripting XSS vulnerability in SAP NetWeaver JAVA JDBC Test Servlet, an unauthenticated attacker could craft a URL that embeds a malicious script. If a victim clicks this link, the injected input is processed during web page generation, resulting in the execution of...

PT-2026-48315

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.0 through 5.7.23 Spring Security versions 5.8.0 through 5.8.25 Spring Security versions 6.3.0 through 6.3.16 Spring Security versions 6.4.0 through 6.4.16 Spring Security versions 6.5.0 through 6.5.10 Spring Securi...

CVE-2026-48288: Improper Input Validation

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-47991: URL Redirection to Untrusted Site

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect Open Redirect vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation ...

CVE-2026-28301: URL Redirection to Untrusted Site

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website...

CVE-2026-41844: URL Redirection to Untrusted Site

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

CVE-2026-44757: Improper Neutralization of Input During Web Page Generation

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the...