CVE-2026-6445: Improper Authorization in Handler for Custom URL Scheme

A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges...

CVE-2026-41844: URL Redirection to Untrusted Site

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...

CVE-2026-48289: Improper Input Validation

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-48288: Improper Input Validation

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write...

CVE-2026-47991: URL Redirection to Untrusted Site

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect Open Redirect vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation ...

CVE-2026-47347: URL Redirection to Untrusted Site

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This...

PT-2026-47740

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 Description Applications utilizing the...

TYPO3 CMS input validation vulnerability

TYPO3 CMS is a content management system developed under the TYPO3 open source framework. There is a vulnerability in input validation of TYPO3 CMS, which stems from the GeneralUtility::sanitizeLocalUrl function. This function allows URLs to be used for redirection even after cleaning, potentiall...

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

Summary An unauthenticated attacker Alice connects to FUXA's Socket.IO endpoint and emits a device-webapi-request event whose property.address field names an arbitrary URL. FUXA's DEVICEWEBAPIREQUEST handler at server/runtime/index.js:296 calls axios.getaddress server-side and broadcasts the full...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the Insert and Update processes in the browser plugin components, where user-supplied input is interpolated directly into AppleScript or JXA templates without proper escaping. An attacker can execute arbitra...

PHPSpreadsheet has a patch bypass for CVE-2026-34084

Summary CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path conta...

CVE-2026-11582

creationtimestamp| type| source ---|---|--- 2026-06-08 21:43:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsnmjzlmj2q 2026-06-08 22:28:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnsq2m4kgj2f...

CVE-2026-47345

creationtimestamp| type| source ---|---|--- 2026-06-08 20:57:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsl3enfz62j...

CVE-2026-44541

fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden valu...

CVE-2026-39910

creationtimestamp| type| source ---|---|--- 2026-06-08 19:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsgt6ropt23 2026-06-22 01:02:05+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motoshdiat2m...

CVE-2026-11687

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 04:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mntcpn7sl52x 2026-06-15 18:00:00+00:00|...

CVE-2026-11691

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 00:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsyaoo5sp2h 2026-06-15 18:00:00+00:00| seen|...

CVE-2026-11685

creationtimestamp| type| source ---|---|--- 2026-06-08 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260609 2026-06-09 00:43:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnsxpmsg252p 2026-06-15 18:00:00+00:00| seen|...

GHSA-W8P2-R796-3VMQ Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

Summary Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a...