CVE-2026-65604 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

CVE-2024-58353

Cal.com repository calcom/cal.diy in versions = 4.7.15 is vulnerable to cross-site scripting XSS on the publicly accessible single booking view e.g., /booking/. Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an...

CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

CVE-2026-48012

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...

GHSA-WRJC-X8RR-H8H6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router versions = 7.9.6, = 7.12.0...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...

React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirect. An attacker can cause users to be redirected to malicious external sites or execute unauthorized scripts by enticing them to click crafted links. Remediation Upgrade org.webjars.npm:react-router to versio...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirect. An attacker can cause users to be redirected to malicious external sites or execute unauthorized scripts by enticing them to click crafted links. Remediation Upgrade react-router to version 7.13.0 or...

GHSA-JJMJ-JMHJ-QWJ2 React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

AperiSolve v3.6.0

Aperi'Solve Try it now: https://www.aperisolve.com Support Aperi'Solve: Aperi'Solve is an open-source steganalysis web platform that performs automated analysis on...

CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-48012

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-48012

Summary: CVE-2026-48012 is an open redirect in Shopware’s public SSO endpoint (/api/oauth/sso/auth) affecting Shopware versions 6.7.3.0–6.7.10.0. When an SSO session state is missing, the code falls back to the Referer header to build the redirect destination without enforcing same-origin, relati...