Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,135 results · page 7 of 43
May 20, 2026Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writesCVE-2026-29518 · Other software · RsyncProject · reported by VulnCheckHigh 7.3
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
- Product
- rsync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026A flaw was found in Keycloak's URL validation logic during redirect operations.CVE-2026-7504 · Other software · Red Hat · reported by Red HatHigh 8.1
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited. The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.
- Product
- Red Hat build of Keycloak 26.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
May 14, 2026CWE-601 URL redirection to untrusted site ('open redirect')CVE-2026-45448 · Other software · ntop · reported by cna@cyber.gov.ilMedium 4.3
CWE-601 URL redirection to untrusted site ('open redirect')
- Product
- ntopng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitiCVE-2026-44503 · Computers, phones & browsers · microsoft · reported by GitHubHigh 7
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
- Product
- kiota-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Unauthorized modification of dataCVE-2026-3829 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
- Product
- WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
- Affected
- up to 7.8.5.10
- What to do
- Affects up to 7.8.5.10. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 13, 2026When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause thCVE-2026-42409 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to CVE-2026-6429 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 5.3
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.CVE-2026-8368 · Other software · OALDERS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
- Product
- LWP::UserAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026WP-Redirection: Cross-Site Request ForgeryCVE-2026-7562 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to the absence of a nonce field in the admin settings form and the lack of any nonce verification (via check_admin_referer() or wp_verify_nonce()) in the displayWPRedirectionManagementPage() function before processing POST requests that add, edit, or delete URL redirection rules. This makes it possible for unauthenticated attackers to trick a logged-in administrator into clicking a crafted link, causing the attacker to create, modify, or delete redirection records in the plugin's database table without the administrator's consent.
- Product
- WP-Redirection
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP-Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 12, 2026Tm – WordPress Redirection: Cross-Site Request ForgeryCVE-2026-7561 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Tm – WordPress Redirection
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Tm – WordPress Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 11, 2026SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to aCVE-2026-40137 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.
- Product
- Business Server Pages Application (TAF_APPLAUNCHER)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform.CVE-2026-3318 · Websites & servers · Cradle · reported by cve-coordination@incibe.esMedium 5.3
Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.
- Product
- e-commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc.CVE-2026-6795 · Other software · DivvyDrive Information Technologies Inc. · reported by iletisim@usom.gov.trCritical 9.6
URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Parameter Injection. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2.
- Product
- DivvyDrive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs.CVE-2026-40332 · Other software · MasaCMS · reported by GitHubMedium 5.3
Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes (//) as internal paths, failing to validate the redirect target before processing. The application treats these values as internal paths and processes them without confirming that the redirect target remains on the local site. An attacker can craft a URL on the trusted Masa CMS domain that redirects a victim to an external attacker-controlled site. This can be used for phishing and, in some authentication flows, may expose tokens or other sensitive data to the external site. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, reject or rewrite redirect parameters that begin with // and consider disabling forceDirectoryStructure if compatible with the deployment.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes ouCVE-2026-44112 · Other software · OpenClaw · reported by VulnCheckHigh 8.4
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor.CVE-2026-41226 · Other software · Ricoh Company, Ltd. · reported by vultures@jpcert.or.jpMedium 5.1
Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.
- Product
- Multiple laser printers and MFPs which implement Web Image Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perfCVE-2026-42525 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
- Product
- Jenkins Microsoft Entra ID (previously Azure AD) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checksCVE-2026-42430 · Other software · OpenClaw · reported by VulnCheckMedium 4.8
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets that should be restricted by browser SSRF protections.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted CVE-2026-30346 · Other software · reported by MITREMedium 4.3
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 23, 2026Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.CVE-2026-33102 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2026An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation.CVE-2026-4296 · Other software · GitHub · reported by product-cna@github.comHigh 7.5
An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when clicked by a victim, would redirect the OAuth authorization code to an attacker-controlled domain. This could allow the attacker to gain unauthorized access to the victim's account with the scopes granted to the OAuth application. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Apr 21, 2026follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.CVE-2026-40895 · Other software · follow-redirects · reported by GitHubMedium 6.9
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
- Product
- follow-redirects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Apr 21, 2026An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login CVE-2026-0971 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 4.3
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
- Product
- GoAnywhere MFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a maliciouCVE-2026-20060 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.7
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page.
- Product
- Cisco Unity Connection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 14, 2026Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.CVE-2026-32216 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally.
- Product
- Windows 11 version 26H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versCVE-2026-21741 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.4
An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary website via crafted CSV file.
- Product
- FortiNAC-F
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Apr 13, 2026Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a vicCVE-2026-34257 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026User Registration & Membership: Open RedirectCVE-2026-6203 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.
- Product
- User Registration & Membership
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 13, 2026Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parCVE-2026-40039 · Other software · Pachno · reported by VulnCheckHigh 7.1
Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.
- Product
- Pachno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzeroscience.mk
Apr 10, 2026An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML eCVE-2026-22560 · Other software · Rocket.Chat · reported by support@hackerone.comMedium 5.3
An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Apr 9, 2026Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.CVE-2026-25854 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
- Product
- Hide My WP Ghost
- What to do
- Update Hide My WP Ghost to the newest version.
Apr 6, 2026An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL.CVE-2025-61166 · Other software · Ascertia · reported by MITREMedium 6.1
An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL.
- Product
- Signinghub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinkedin.commedium.com
Apr 3, 2026OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL.CVE-2026-34511 · Other software · OpenClaw · reported by VulnCheckMedium 6
OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL.CVE-2024-58342 · Other software · XenForo · reported by VulnCheckMedium 5.3
XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches.
- Product
- XenForo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comxenforo.com
Mar 31, 2026In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.CVE-2026-4799 · Other software · floragunn · reported by security@search-guard.comMedium 4.3
In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
- Product
- Search Guard FLX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.search-guard.comsearch-guard.com
Mar 30, 2026Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitatiCVE-2026-27508 · Other software · Smoothwall · reported by VulnCheckMedium 5.1
Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.
- Product
- Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.smoothwall.orgvulncheck.com
Mar 25, 2026Premmerce Redirect Manager: Missing AuthorizationCVE-2026-32541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through <= 1.0.12.
- Product
- Premmerce Redirect Manager
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Premmerce Redirect Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2026Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.CVE-2026-1166 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 4.3
Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.
- Product
- Hitachi Ops Center Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2026Redirect countdown: Cross-Site Request ForgeryCVE-2026-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the `countdown_settings_content()` function. This makes it possible for unauthenticated attackers to update the plugin settings including the countdown timeout, redirect URL, and custom text, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Redirect countdown
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Redirect countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files CVE-2025-15607 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.3
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
- Product
- AX53 v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Mar 20, 2026Membership Plugin – Restrict Content: Unvalidated RedirectCVE-2026-4136 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redirect url supplied via the 'rcp_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Membership Plugin – Restrict Content
- Affected
- up to 3.2.24
- What to do
- Affects up to 3.2.24. Update Membership Plugin – Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads.CVE-2026-32037 · Other software · OpenClaw · reported by VulnCheckLow 2.3
OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-aCVE-2026-31989 · Other software · OpenClaw · reported by VulnCheckMedium 5.3
OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host to loopback, private, or internal destinations.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 18, 2026A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuCVE-2026-4366 · Other software · Red Hat · reported by Red HatMedium 5.8
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
- Product
- Red Hat build of Keycloak 26.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 17, 2026The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.CVE-2026-4202 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aLow 2.3
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
- Product
- Extension "Redirect Tabs"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.CVE-2026-20994 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.9
URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 11, 2026When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hosCVE-2026-3783 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 5.3
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026IFTOP developed by WellChoose has an Open redirect vulnerability, allowing authenticated remote attackers to craft a URL that tricks users into visiting malicioCVE-2026-3824 · Other software · WellChoose · reported by twcert@cert.org.twMedium 5.1
IFTOP developed by WellChoose has an Open redirect vulnerability, allowing authenticated remote attackers to craft a URL that tricks users into visiting malicious website.
- Product
- IFTOP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 11, 2026A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.CVE-2026-23817 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.
- Product
- AOS-CX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.