123352 matches found
CVE-2026-53573: URL Redirection to Untrusted Site
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...
CVE-2026-45377: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...
CVE-2026-52232: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-62999: Improper Limitation of a Pathname to a Restricted Directory
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...
CVE-2026-53504: Uncontrolled Resource Consumption
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...
CVE-2026-67350: URL Redirection to Untrusted Site
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...
IBM Langflow OSS path traversal vulnerability
IBM Langflow OSS is an open-source low-code visual AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to integrate wit...
PT-2026-66729
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the SAML protocol implementation when handling authentication requests via the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)
Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...
openSUSE 16 Security Update : libkrun (openSUSE-SU-2026:21464-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21464-1 advisory. - CVE-2025-24898: openssl: use-after-free in ssl::selectnextproto due to improper lifetime handling bsc1270429. - CVE-2026-41676: openssl: short...
Linux Distros Unpatched Vulnerability : CVE-2026-18446
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based...
React Router Redirection Phishing
The vulnerability of the React Router routing library for React applications relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks...
CVE-2026-55768
creationtimestamp| type| source ---|---|--- 2026-07-30 22:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i756bnxfs3slr...
CVE-2026-11536
creationtimestamp| type| source ---|---|--- 2026-07-30 22:16:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrvhpxhewy2y 2026-08-06 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgbdb2yns2v...
CVE-2026-67530
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...
CVE-2026-14602
creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva4fhjpv2v 2026-08-06 20:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgu7ogxhb2c...
CVE-2026-64870
MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
