CVE-2026-40332 Masa CMS open redirect via improper handling of scheme-relative URLs

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes // as internal paths, failing to validate the redirect target before processing. The application treats these values ...

CVE-2026-40332 Masa CMS open redirect via improper handling of scheme-relative URLs

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes // as internal paths, failing to validate the redirect target before processing. The application treats these values ...

EUVD-2026-28216

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes // as internal paths, failing to validate the redirect target before processing. The application treats these values ...

CVE-2026-40332

Masa CMS is affected by an Open Redirect vulnerability caused by improper handling of scheme-relative URLs. The system misinterprets paths beginning with // as internal and processes them without validating that the redirect target stays on the local site. An attacker can craft a link on the trus...

CVE-2026-40332 Masa CMS open redirect via improper handling of scheme-relative URLs

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes // as internal paths, failing to validate the redirect target before processing. The application treats these values ...

CVE-2026-43174

A flaw was found in the Linux kernel's iouring/zcrx subsystem. Incorrect error handling during post-open operations allows for the direct release of zcrx ctx without ensuring that all associated page pools are properly terminated. This resource management issue could lead to system instability or...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the trainerlogin function. An attacker can redirect a user's browser to an external, attacker-controlled URL by supplying a crafted next parameter, potentially exposing sensitive information such as the original URL...

GHSA-VQV8-J3MJ-WJXJ wger: trainer_login open redirect - ?next= parameter not validated against host

Summary The trainerlogin view in wger redirects to request.GET'next' directly via HttpResponseRedirect without calling urlhasallowedhostandscheme. After the trainer successfully enters impersonation mode, their browser is redirected to any attacker-controlled URL supplied in the ?next= parameter,...

wger: trainer_login open redirect - ?next= parameter not validated against host

Summary The trainerlogin view in wger redirects to request.GET'next' directly via HttpResponseRedirect without calling urlhasallowedhostandscheme. After the trainer successfully enters impersonation mode, their browser is redirected to any attacker-controlled URL supplied in the ?next= parameter,...

CVE-2026-44112 OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write...

CVE-2026-41314 vulnerabilities

Vulnerabilities for packages: open-webui, litellm, nemo...

CVE-2026-41312 vulnerabilities

Vulnerabilities for packages: open-webui, litellm, nemo...

CVE-2026-41313 vulnerabilities

Vulnerabilities for packages: open-webui, litellm, nemo...

CVE-2026-41168 vulnerabilities

Vulnerabilities for packages: open-webui, litellm, nemo...

CVE-2026-41182 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, librechat, open-webui, kibana...

CVE-2026-42215 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, opal, awx, checkov, open-webui, mlflow-fips, mlflow...

CVE-2026-42284 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, opal, awx, checkov, open-webui, mlflow-fips, mlflow...

CVE-2026-41205 vulnerabilities

Vulnerabilities for packages: airflow, airflow-core, dagster-fips, mlflow, pgadmin4-fips, prefect-fips, jupyter-base-notebook, open-webui, nemo, dagster, superset...

CVE-2026-41425 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, airflow, pgadmin4-fips, datahub-ingestion, open-webui, mlflow...

Your Redis Server Looks Fine. That’s the Problem.

Introduction There’s an automated attack circulating right now that breaks into unprotected Redis servers, takes over the underlying machine, and then carefully puts everything back the way it found it. It restores the database filename. It deletes the tools it used. It detaches from the...