EUVD-2026-64670

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78145

CTFd versions up to 3.8.4 are affected by an open redirect vulnerability in the _is_safe_url function within CTFd/utils/validators/__init__.py. A remote attacker with no privileges can manipulate the Next argument to redirect users to an arbitrary URL, requiring only user interaction. The CVSS 3....

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-67346: Server-Side Request Forgery (SSRF)

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...