CWE-601

1,513 vulnerabilities with CWE-601

CVE-2026-42350 MEDIUM

Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

CVE-2026-42195 LOW

Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

CVSS 3.4

CVE-2026-3318 MEDIUM

Cradle eCommerce Login returnUrl Parameter - Open Redirect

CVE-2026-43941 CRITICAL

Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click

CVSS 9.6

CVE-2026-42259 MEDIUM

Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)

CVE-2026-6795 CRITICAL

Open Redirect in DivvyDrive Information Technologies' DivvyDrive

CVSS 9.6

CVE-2026-41670 HIGH

Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest

CVSS 8.2

CVE-2026-40332 MEDIUM

Masa CMS open redirect via improper handling of scheme-relative URLs

CVE-2026-43576 HIGH

OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL

CVSS 7.7

CVE-2026-35253 MEDIUM

Oracle Macaron Tool v0.22.0 - Unauthenticated Origin Validation Error via HTTP

CVSS 4.7

CVE-2026-42230 MEDIUM

n8n: Open Redirect in MCP OAuth Consent Flow

CVSS 6.1

CVE-2026-41226 MEDIUM

Ricoh Company, Ltd. Multiple Laser Printers And MFPs Which Implement Web Image Monitor - Open Redirect

CVSS 4.7

CVE-2026-42525 MEDIUM

Jenkins Microsoft Entra ID Plugin <=666.v6060de32f87d - Open Redirect

CVSS 4.3

CVE-2026-30346 MEDIUM

hunvreus DevPush 0.3.2 - Open Redirect via Google Authorize Endpoint

CVSS 4.3

CVE-2026-33102 CRITICAL

Microsoft 365 Copilot Elevation of Privilege Vulnerability

CVSS 9.3

CVE-2026-41126 MEDIUM

BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"

CVSS 4.3

CVE-2026-40905 HIGH

LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover

CVSS 8.1

CVE-2026-34315 MEDIUM

Oracle WebLogic Server 12.2.1.4.0 to 15.1.1.0.0 - Unauthorized Data Modification

CVSS 6.5

CVE-2026-34284 MEDIUM

Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 - Unauthorized Data Access

CVSS 6.1

CVE-2026-34283 MEDIUM

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.0.0 - Unauthorized Data Access

CVSS 6.1

CVE-2026-40299 MEDIUM

next-intl <4.9.1 Middleware - Open Redirect

CVE-2026-40255 MEDIUM

@adonisjs/http-server redirect().back() - Open Redirect

CVSS 6.1

CVE-2026-20060 MEDIUM

Cisco Unity Connection Open Redirect Vulnerability

CVSS 4.7

CVE-2026-40096 MEDIUM

immich: Open Redirect via Shared Album name

CVSS 5.4

CVE-2026-21741 LOW

FortiNAC-F 7.2.0-7.6.5 - Authenticated Open Redirect via Crafted CSV File

CVSS 2.4