CVE-2026-54215

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

CVE-2026-54215

CVE-2026-54215 affects Tobit Laboratories AG TeamDavid’s Webbox (through Rollout 524). The vulnerability is an open redirect triggered by the replyUrl parameter, enabling an attacker to craft a URL that redirects users’ browsers to an arbitrary third-party site. This can be abused for phishing by...

CVE-2026-54215 TeamDavid: Open Redirect via the 'replyUrl' parameter

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

EUVD-2026-54446

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for...

CVE-2026-54214

CVE-2026-54214 describes an HTTP header injection vulnerability in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability arises from the vulnerable Type URL parameter, which can inject control characters (e.g., URL-encoded newlines %0a and colons) to modify the Content-Type header in HTTP...

CVE-2026-54214 TeamDavid: Header Injection through the 'cType' URL parameter

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

EUVD-2026-54445

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

CVE-2026-54214

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded...

CVE-2026-12071

The CVE-2026-12071 issue affects the Webbox of TeamDavid by Tobit Laboratories AG. The vulnerability stems from how redirect URLs are constructed using user-supplied input, which is appended to the redirect target in a 302 HTTP response. Technical details in the connected documents show that atta...

CVE-2026-12071 TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

net: openvswitch: reject oversized nested action attrs

...

Double-free in the iSNS attribute decoder in open-iscsi

...

iscsiuio control-socket authentication bypass in open-iscsi

...

remote limited file-write as root via discovery in open-iscsi

...

CVE-2026-16262

The CVE affects the Estatik Real Estate Plugin for WordPress (versions before 4.3.3). The vulnerability arises because the plugin does not bind the OAuth social login flow to the initiating user session, enabling an unauthenticated attacker to perform a login CSRF and have the victim’s subsequent...

CVE-2025-63235

CVE-2025-63235 affects the sol broker. Affected behavior: when handling malformed or duplicate CONNECT packets (e.g., due to repeated attempts or failed authentication), the broker may not fully release resources, possibly dropping the connection or leaving the session and internal resources allo...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

EUVD-2025-210649

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScript...