CVE-2026-52802

Summary: CVE-2026-52802 affects Gogs prior to version 0.14.3, exposing an open redirect in redirects validated by IsSameSite. The check only examines the first two characters of the redirect_to value, failing to account for directory traversal sequences (e.g., /a/../\example.com). When browsers n...

CVE-2026-13163

Open redirect vulnerability CWE-601 in the saferedirect function of the click-tracking endpoint /c// in Mailerup 1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the...

EUVD-2026-38759

Open redirect vulnerability CWE-601 in the saferedirect function of the click-tracking endpoint /c// in Mailerup 1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites is related to access control errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the WebCenter Sites component for user-serviceing applications on the internet allows a perpetrator to gain unauthorized access to create, delete, or modify data.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create, delete, or modify data...

GHSA-XXHQ-69MF-W8CR Gogs has an Open Redirect via redirect_to

Summary An open redirect vulnerability exists in Gogs where attacker-controlled redirectto parameters can bypass validation, allowing redirection to arbitrary external sites. Details All redirects in Gogs that are validated via the IsSameSite function are vulnerable: go func IsSameSiteurl string...

CVE-2026-7859

The Motors Car Dealership & Classified Listings WordPress plugin (versions before 1.4.110 ) is vulnerable to an unauthenticated post-meta write due to a lack of proper authorization and CSRF checks on the stm_ajax_add_a_car_media AJAX action. An unauthenticated attacker can exploit this to modify...

Oracle WebCenter Sites (June 2026 CSPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported...

CVE-2026-56332 Capgo - Open Redirect via confirmation_url Parameter

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmationurl parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting...

EUVD-2026-38127

Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmationurl parameter is not validated, enabling attackers to craft malicious links for phishing and credential harvesting...

Open Redirect

Gitea is vulnerable to Open Redirect. The vulnerability is due to improper validation of redirectto values, where raw or percent-encoded backslashes can bypass redirect validation, allowing attackers to redirect users to attacker-controlled websites...

FIFA World Cup 2026: Hackers Target Football Fans With Fake Tickets Sites

Cybersecurity experts warn that active hacking networks are using fake hotel bookings, cloned websites, and live chat features to scam FIFA World Cup 2026 fans...

PT-2026-50723

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4 Description Kirby sites and plugins that process untrusted input using the writer or list fields, or specific sanitization methods, are subject to stored cross-site scripting XSS. XSS...

Cross-Origin Resource Sharing (CORS) Misconfiguration

hono is vulnerable to Cross-Origin Resource Sharing CORS Misconfiguration. The vulnerability is due to reflecting arbitrary Origin headers while allowing credentials when no explicit origin is configured, which allows an attacker-controlled website to make authenticated cross-origin requests and...

EUVD-2026-37327

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37318

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37319

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37315

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...