GHSA-CVRM-5HP6-H523 SimpleSAMLphp casserver: Open Redirect in logout

Summary The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either depending on configuration redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. There are a number of other things broke...

CVE-2026-8454

creationtimestamp| type| source ---|---|--- 2026-05-15 14:36:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvklyctod2q 2026-05-15 20:15:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlw5izwcdv2x 2026-05-16 11:41:16+00:00| seen|...

CVE-2026-42030

A flaw was found in MapServer, a system for developing web-based Geographic Information System GIS applications. A reflected Cross-Site Scripting XSS vulnerability in MapServer's Web Map Service WMS server allows an unauthenticated attacker to inject arbitrary HTML or JavaScript code into the...

CVE-2026-8425

creationtimestamp| type| source ---|---|--- 2026-05-15 11:41:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvas5mldv2o...

Exploit for CVE-2026-42897

CVE-2026-42897 - Exchange Health Checker Outbound Rewrite Rule...

CVE-2026-6403

creationtimestamp| type| source ---|---|--- 2026-05-15 11:21:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlv7pim2z52h 2026-05-15 14:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlvkdulq3o2s...

CVE-2026-45062

creationtimestamp| type| source ---|---|--- 2026-05-15 10:55:59+00:00| published-proof-of-concept| https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm 2026-05-16 09:50:05+00:00| seen| https://bsky.app/profile/dunglas.dev/post/3mlxl2h6gpc2k 2026-05-17 02:40:31+00:00| seen|...

CVE-2026-8398

creationtimestamp| type| source ---|---|--- 2026-05-15 10:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv35uqdzj2k 2026-05-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f...

CVE-2026-5229

creationtimestamp| type| source ---|---|--- 2026-05-15 09:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mluxsxr7ya2y 2026-05-15 10:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv363rg662w 2026-05-15 11:31:06+00:00| seen|...

CVE-2026-8425

CVE-2026-8425 describes a Cross-Site Request Forgery in the WordPress Notify Odoo plugin (versions ≤ 1.0.1). The root cause is missing or incorrect nonce validation on the _updateSettings function, enabling unauthenticated attackers to alter the Notify Odoo URL and related settings (notification,...

EUVD-2026-30520

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to ...

CVE-2026-46433

creationtimestamp| type| source ---|---|--- 2026-05-15 06:27:28+00:00| seen| https://bsky.app/profile/vincent.bernat.ch/post/3mlupbaxxvs2n...

CVE-2025-48512

creationtimestamp| type| source ---|---|--- 2026-05-15 04:36:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mluj2boe2j2n...

CVE-2026-44051

creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b 2026-05-21 13:44:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmekhwn57y2r 2026-05-22 09:00:34+00:00| seen|...

CVE-2026-44054

creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b...

CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

PT-2026-41385

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp-casserver versions prior to 6.3.1 SimpleSAMLphp-casserver versions prior to 7.0.0 Description The logout endpoint accepts a url query parameter for redirection. The server treats this URL as trusted and, depending on the...

phpMyFAQ 跨站脚本漏洞

phpMyFAQ is a multilingual, database-driven FAQ system developed by Thorsten Rinne. Versions of phpMyFAQ prior to 4.1.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the Utils::parseUrl function, which allowed authenticated users to inject JavaScript through...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Versions of Open WebUI prior to 0.8.0 had a cross-site scripting vulnerability. This vulnerability stemmed from the profileimageurl field in the user profile update form accepting arbitrary data: URI...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI under open source. Versions of Open WebUI prior to 0.9.3 contained a security vulnerability. This vulnerability stemmed from the channel webhook creation/update process accepting arbitrary profileimageurl values,...