CVE-2026-80428: Deserialization of Untrusted Data

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

PT-2026-89158

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An asymmetric resource consumption issue exists in the OIDC back-channel logout handler. When the ENABLE OAUTH BACKCHANNEL LOGOUT setting is enabled and an OIDC provider is configured, the...

CVE-2026-79664: Insufficient Session Expiration

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero,...

CVE-2026-9033 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

CVE-2026-9033 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

CVE-2026-40509

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...

EUVD-2026-62510

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...

CVE-2026-40509

OpenEMR before 8.3.0 is affected by a cross-site request forgery (CSRF) vulnerability in the DICOM viewer . The web_path GET parameter is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a malicious URL that causes an authenticated user holding...

CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...

CVE-2026-40509 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...

CVE-2026-40509: Cross-Site Request Forgery (CSRF)

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The webpath GET parameter in the DICOM viewer page is embedded unsanitized as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with...

CVE-2026-73671

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-73671 Saurus CMS Unauthenticated Open Redirect via logout url parameter

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-73671 Saurus CMS Unauthenticated Open Redirect via logout url parameter

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

EUVD-2026-58111

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-73671

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-73671

Saurus CMS Community Edition is affected by an unauthenticated open redirect in the logout handling code (classes/port.inc.php). The vulnerability occurs because the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlisting, scheme validation, or...

PT-2026-71692

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-48079

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

EUVD-2026-54150

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...