CVE-2026-111754

The @angular/platform-server and @angular/ssr packages are vulnerable to an Open Redirect vulnerability in Server-Side Rendering (SSR) environments. The root cause is that ServerPlatformLocation performs protocol-relative URL checks before WHATWG URL normalization. Attackers can provide a request...

CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A...

PT-2026-134409

Summary The URL validation regex ^https?:/?/. added to emissary's NavAction.java allows protocol-relative URLs //evil.com/... and single-slash scheme variants http:/evil.com to bypass validation, enabling SSRF and open redirect attacks. Affected Package - Ecosystem: Maven - Package:...

GHSA-PW9P-V7R6-GX4P Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578

The Tornado Python web framework and asynchronous networking library (versions prior to 6.6 ) is vulnerable to an open redirect in tornado.web.RedirectHandler. The root cause is that URL templates allow regex-capture substitutions in positions where crafted request paths can modify the redirect s...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

Open Redirect

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Open Redirect via enhanced form actions use:enhance when handling routes that accept paths beginning with //, such as catch-all routes. An attacker can craft action paths starting with //...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to an open redirect vulnerability within the enhanced form actions (use:enhance). The issue occurs on routes that accept paths starting with a double slash (//). Attackers can craft action paths starting with // to create protocol-re...

PT-2026-120186

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description An open redirect issue exists in enhanced form actions use:enhance on routes that accept paths starting with a double slash. Attackers can create action paths beginning with // that...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

WS-2026-0105

@angular/platform-server 17.0.0-rc.1 before 20.3.33, 21.2.25 and 22.2.1: ServerPlatformLocation rejects protocol-relative URLs before WHATWG URL normalization, so a path such as /.//evil.test normalizes to //evil.test and Angular SSR emits it in a Location header, an open redirect. Lines 17-19 ar...

CVE-2026-86351

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...