open-redirect-poc

Open Redirect PoC - CVE-2025-58044 📋 Description This is...

[SECURITY] Fedora 44 Update: chromium-150.0.7871.128-1.fc44

Chromium is an open-source web browser, powered by WebKit Blink...

opencti v7.260722.0

Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of th...

Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OAuth flow handli...

CVE-2026-48012: URL Redirection to Untrusted Site

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-65908: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

PT-2026-67356

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

CVE-2026-65604: Improper Input Validation

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

PT-2026-64214

Name of the Vulnerable Software and Affected Versions React Router versions 6.30.2 through 6.30.4 React Router versions 7.9.6 through 7.12.0 Description Applications that allow open redirects are susceptible to Cross-Site Scripting XSS, a technique where malicious scripts are injected into truste...

PT-2026-64179

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16 Description Cross-site scripting XSS occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels...

tomcat9 update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

LLM agents increasingly rely on external tools, expanding capability while creating a new security boundary: third-party tools may appear benign at the interface level while embedding unsafe behavior in implementation. Existing defenses rely on weak metadata, collapse characterization and policy...

Not Failing Securely ('Failing Open')

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the install function of PyPIExtensionManager when the allowlist/blocklist check is not properly enforced due to a missing await. An attacker ca...

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

GHSA-P9J2-GV94-2WF4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-59821 via litellm (0.7.10)

litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.31 Source cves: CVE-2026-59821 Source advisory: OSV:GHSA-72M8-9M7M-H278...

fastrepl (>=0.0.21, <=0.0.25), funcflow (0.0.3) +2 more potentially affected by CVE-2026-59821 via litellm (0.8.6)

litellm PYPI version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - fastrepl =0.0.21, =0.0.5, =0.0.9 Source cves: CVE-2026-59821 Source advisory: OSV:GHSA-72M8-9M7M-H278...

bavisitter (>=0.0.0, <=0.1.0rc1), cosmoai (>=0.8.8, <=0.9.1.11) +1 more potentially affected by CVE-2026-59821 via litellm (0.13.0)

litellm PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - bavisitter =0.0.0, =0.8.8, =0.9.1.11 - open-interpreter 0.1.11 Source cves: CVE-2026-59821 Source advisory: OSV:GHSA-72M8-9M7M-H278...

open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-59821 via litellm (0.13.2)

litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2026-59821 Source advisory: OSV:GHSA-72M8-9M7M-H278...

open-interpreter (>=0.1.8, <=0.1.9), openplugin (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-59822 via litellm (0.7.10)

litellm PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.8, =0.0.25, =0.0.31 Source cves: CVE-2026-59822 Source advisory: OSV:GHSA-7488-6R32-C95Q...