CWE-601

1,513 vulnerabilities with CWE-601

CVE-2026-45307 MEDIUM

Speakr: Open redirect in is_safe_url via parser mismatch on next parameter

CVSS 6.1

CVE-2026-44681 MEDIUM

Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

CVSS 6.1

CVE-2026-45335 MEDIUM

WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage

CVSS 5.4

CVE-2026-49059 MEDIUM

WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability

CVSS 4.7

CVE-2026-48924 MEDIUM

Jenkins Bitbucket OAuth Plugin < 0.17 - URL Redirection to Untrusted Site ('Open Redirect')

CVSS 4.3

CVE-2026-44833 MEDIUM

Snipe-IT: Open redirect vulnerability

CVSS 5.9

CVE-2026-48589 MEDIUM

Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

CVSS 5.4

CVE-2026-44598 MEDIUM

Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)

CVSS 5.4

CVE-2026-47070 MEDIUM

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

CVSS 6.1

CVE-2026-48832 LOW

Spip < 4.4.15 - URL Redirection to Untrusted Site ('Open Redirect')

CVSS 3.5

CVE-2026-40295 MEDIUM

Devise: Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler

CVSS 6.1

CVE-2026-9245 MEDIUM

Devolutions Server - URL Redirection to Untrusted Site ('Open Redirect')

CVSS 5.0

CVE-2026-2813 MEDIUM

Unvalidated Redirect in ArcGIS Server

CVSS 4.7

CVE-2026-7504 HIGH

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

CVSS 8.1

CVE-2026-45037 HIGH

Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation

CVSS 7.1

CVE-2026-42207 MEDIUM

Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts

CVSS 6.1

CVE-2026-44427 NONE

MCP Registry: Open Redirect

CVE-2026-44520 MEDIUM

Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler

CVSS 5.7

CVE-2026-45448 MEDIUM

ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

CVSS 4.3

CVE-2026-44503 HIGH

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

CVE-2026-44437 MEDIUM

Angular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

CVSS 6.1

CVE-2026-45055 HIGH

CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CVSS 8.1

CVE-2026-44372 MEDIUM

Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

CVSS 6.1

CVE-2026-41513 MEDIUM

Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints

CVE-2026-42565 MEDIUM

@workos/authkit-session: Open Redirect via state-derived redirect target

CVSS 4.3