Astro - Unauthorized Third-Party Image Access

Astro 5.13.2 and 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment. id:...

CVE-2026-111754

The @angular/platform-server and @angular/ssr packages are vulnerable to an Open Redirect vulnerability in Server-Side Rendering (SSR) environments. The root cause is that ServerPlatformLocation performs protocol-relative URL checks before WHATWG URL normalization. Attackers can provide a request...

CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

PT-2026-134409

Summary The URL validation regex ^https?:/?/. added to emissary's NavAction.java allows protocol-relative URLs //evil.com/... and single-slash scheme variants http:/evil.com to bypass validation, enabling SSRF and open redirect attacks. Affected Package - Ecosystem: Maven - Package:...

GHSA-PW9P-V7R6-GX4P Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

EUVD-2026-108941

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf...

GHSA-9JHJ-WVMW-CFX5 i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.3...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578

The Tornado Python web framework and asynchronous networking library (versions prior to 6.6 ) is vulnerable to an open redirect in tornado.web.RedirectHandler. The root cause is that URL templates allow regex-capture substitutions in positions where crafted request paths can modify the redirect s...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references. Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation...

GHSA-W47M-J727-M843 Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references. Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview org.webjars.npm:i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injectio...