CVE-2026-55840 Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolu...

CVE-2026-55840 Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolu...

Feathers Access Control Vulnerability

Feathers is a lightweight web framework developed by Feathers OpenSource. It is used to create APIs and real-time applications using TypeScript or JavaScript. Feathers versions 5.0.39 and earlier have a security vulnerability related to access control. This vulnerability stems from the use of the...