990705 matches found
CVE-2026-83646
Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
CVE-2026-83500
Url redirection to untrusted site 'open redirect' in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...
CVE-2026-103576
Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-103576
A URL redirection to an untrusted site (open redirect ) vulnerability exists in Active Directory Federation Services (AD FS) . This flaw allows an unauthorized attacker to perform spoofing over a network. The vulnerability is associated with CWE-601 . While a base score of 6.5 is assigned, the do...
CVE-2026-83646
A URL redirection to an untrusted site (open redirect ) vulnerability exists in Active Directory Federation Services (AD FS) . This flaw allows an authorized attacker to perform spoofing over a network. The vulnerability is categorized under CWE-601 and has a Medium base severity score of 4.8. No...
CVE-2026-83500
A URL redirection to an untrusted site (open redirect) vulnerability exists in Windows BitLocker . This flaw allows an unauthorized attacker to perform a physical attack to bypass a security feature. No specific exploit code or in-the-wild exploitation details are provided in the documents. Remed...
CVE-2026-93187
A flaw was found in the Linux kernel's Sound Open Firmware SOF IPC4 topology component. When internal functions sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc are invoked with an invalid number of input or output formats specifically, zero, they incorrectly report a successful operation...
CVE-2026-66057
The Frappe web application framework is vulnerable to an Open Redirect (CWE-601) because the OAuth login flow fails to sanitize a client-controlled state parameter . This parameter is used to determine post-authentication navigation, allowing an attacker to craft a state value that redirects user...
CVE-2026-66057 Frappe: Open Redirect via Unsanitized OAuth State Param.
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fix...
CVE-2026-66057
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fix...
CVE-2026-66057 Frappe: Open Redirect via Unsanitized OAuth State Param.
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fix...
CVE-2026-90196
A flaw was found in the Linux kernel's Sound Open Firmware SOF component. This vulnerability occurs due to improper validation of topology mixer volume ranges. An attacker could potentially provide malformed volume range values, leading to an integer overflow during memory allocation. This could...
Windows BitLocker Security Feature Bypass Vulnerability
Url redirection to untrusted site 'open redirect' in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an authorized attacker to perform spoofing over a network...
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Url redirection to untrusted site 'open redirect' in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-109409 HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The...
CVE-2026-109409
A command injection vulnerability exists in the HBAI-Ltd Toonflow-app up to version 1.1.8 . The flaw is located in the child_process.exec function within the file src/routes/setting/fileManagement/openFolder.ts of the Open Folder Endpoint component. An attacker can trigger command injection by ma...
CVE-2026-109160
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the...
CVE-2026-109160 PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the...
CVE-2026-109160
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the...