Linux Distros Unpatched Vulnerability : CVE-2026-47887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open...

onecli v2.0.1

The agent harness built for teams. A pro assistant for companies. Give every employee a secured, sandboxed personal agent. Website · Docs · Discord Quick Start Cloud-hosted: onecli.sh Self-hosted root@kitploit: git clone https://github.com/onecli/onecli.git && cd onecli pnpm install pnpm run setu...

Linux Distros Unpatched Vulnerability : CVE-2026-82467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and...

CVE-2026-82467

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

CVE-2026-82464

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82467

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

CVE-2026-82467

Rodauth before 2.47.0 is affected by an open redirect vulnerability in its confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. The root cause is a failure to validate protocol-relative return-to paths : an attacker can craft paths begin...

CVE-2026-82467 Rodauth before 2.47.0 Open Redirect via Return-to Path

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

EUVD-2026-68124

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

CVE-2026-82467 Rodauth before 2.47.0 Open Redirect via Return-to Path

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

EUVD-2026-68121

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82464 pac4j-core before 6.5.6 Open Redirect via Backslash Logout

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82464

pac4j-core versions before 6.5.6 are affected by an open redirect vulnerability in the DefaultLogoutLogic.perform() method. The component accepts backslash-prefixed logout redirect targets that match the configured logoutUrlPattern. Because browsers normalize a backslash into a network-path refer...

CVE-2026-82464 pac4j-core before 6.5.6 Open Redirect via Backslash Logout

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

CVE-2026-81342

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81342

MasterStudy LMS WordPress Plugin versions prior to 3.7.43 are affected by an unauthenticated open redirect . The plugin fails to validate a redirect parameter supplied during user registration before using it, allowing an attacker to redirect users to arbitrary external URLs. The vulnerability re...

EUVD-2026-68064

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

EUVD-2026-67962

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...