CVE-2026-86351

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

EUVD-2026-72343

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86351

MISP (versions ≤2.5.45 ) is affected by an authenticated open redirect in the user-configurable homepage feature. The validation only checked whether the supplied value begins with /, which is insufficient because protocol-relative URLs such as //attacker.example also start with / but resolve to ...

CVE-2026-86351 MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86315

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MA...

CVE-2026-86313

CVE-2026-86313 is an out-of-bounds write vulnerability in Samsung Opensource Walrus , affecting commit af80e665ea49d9003695a66502f841ed1d8397e7. The flaw allows buffer overflow, rated CVSS 3.1: 7.8 (HIGH) with a local attack vector, low complexity, no required privileges, and user interaction req...

CVE-2026-86315: Numeric Truncation Error

An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16MA...

PT-2026-86858

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...

ROS-20260907-73-0061

The vulnerability in Erlang relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL address...

PT-2026-86679

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

PT-2026-86928

Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...

Online Store Application Code Execution

The vulnerability of the application software interface of programming platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to the lack of measures taken to neutralize special elements in the template creation mechanism...

APSB26-146 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a critical vulnerability that could result in arbitrary code execution. Adobe is aware of CVE-2026-75650 being exploited in the wild...

Crow-Eye v0.13.0

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...

FoxStryker_Scanner

🦊 FoxStryker — Advanced Web Vulnerability Scanner v3.0 FoxStr...

CVE-2026-86256

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...