CVE-2026-121825

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...

CVE-2026-121825

OpenAM (OpenAM Consortium Edition) versions 14.0.5 and earlier are vulnerable to an open redirect (CWE-601) within the Liberty ID-FF service provider single sign-on flow. The root cause is the lack of validation on the goto parameter of the /preLogin endpoint, which is stored as the RelayState of...

EUVD-2026-119785

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...

CVE-2026-121825: OpenAM consortium OpenAM (OpenAM Consortium Edition): OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty…

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...

CVE-2026-123546

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

CVE-2026-123546 OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

EUVD-2026-119431

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

CVE-2026-123546 OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

CVE-2026-123546 OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

CVE-2026-123546

OpenAM versions before 16.1.4 are vulnerable to an open redirect and cross-site scripting (XSS) . The issue originates from the lack of proper validation on the goto and gotoOnFail parameters. Remote attackers can craft malicious login or logout links to redirect victims to phishing sites or exec...

PT-2026-139827

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

CVE-2026-123546: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to…

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run...

SSLPatch

SSL Patch CVE-2014-1266 Copyright c 2014 Linus Yang Introduction CVE-2014-1266 , or known as "goto fail SSL verification exploit", is a very serious SSL/TLS vulnerability of iOS and OS X. Apple issues iOS 6.1.6 and 7.0.6 to fix this problem, but ignores some users who can't or just don't want to...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.10. It arises because after removing matchall entries via sparx5tcmatchalldestroy, no memory is freed, resulting in a memory leak when deleting mirror and goto matchall filters...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrqinit mlx5ibdevressrqinit allocates two SRQs, s0 and s1. When ibcreatesrq fails for s1, the error branch destroys s0 but falls through and unconditionally assigns the freed ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: lpfc: Issues related to ioremap operations in lpfcsli4pcimemsetup have been fixed. When iftype equals zero and pciresourcestartpdev, where PCI64BITBAR4 returns false, drbl regsmemmapp is not remapped. This passes a NULL...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint – Fix for misused goto labels. A misused goto label jump can lead to a memory leak. This issue has been addressed...

CVE-2026-95670 No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-95670 No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/base64 Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104141

Name of the Vulnerable Software and Affected Versions No External Links versions prior to 5.2.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...