共收录 381 条相关情报。
← 返回所有主题CVE-2026-2813
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could e
CVE-2026-7504
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an atta
CVE-2025-65954
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions bel
CVE-2026-45037
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passe
CVE-2026-42207
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun
CVE-2025-65954
### Summary The logout endpoint accepts a `url` query parameter to redirect to. casserver treats that url as trusted,
CVE-2026-44427
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4
CVE-2026-44520
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit sema
CVE-2026-45448
CWE-601 URL redirection to untrusted site ('open redirect')
CVE-2026-44503
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and othe
CVE-2026-44437
The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25,
CVE-2026-45055
CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the
CVE-2026-44372
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using
CVE-2026-44681
### Summary An unauthenticated open redirect in Authlib's `OpenIDImplicitGrant` and `OpenIDHybridGrant` authorization e
CVE-2026-41513
Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirec
CVE-2026-42565
@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirec
CVE-2026-44833
Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Refer
CVE-2026-42350
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Ka
CVE-2026-42195
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts
CVE-2026-43941
### Impact Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to `shell.openExternal