CWE-601

1,628 vulnerabilities with CWE-601

CVE-2026-55431 HIGH

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

CVSS 7.7

CVE-2026-14632 MEDIUM

kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect

CVSS 4.3

CVE-2026-25779 MEDIUM

Gitea redirect handling permits open redirects through backslash paths

CVSS 6.1

CVE-2026-41106 CRITICAL

Microsoft 365 Copilot Elevation of Privilege Vulnerability

CVSS 9.3

CVE-2026-55660 HIGH

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

CVE-2026-58520 MEDIUM

UrlShortener defaults to ineffective validation open to third-party redirects

CVSS 6.1

CVE-2026-58450 MEDIUM

Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter

CVSS 4.3

CVE-2026-10562 MEDIUM

Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface

CVE-2026-40080 MEDIUM

Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect

CVSS 6.1

CVE-2026-52802 MEDIUM

Gogs: Open Redirect via redirect_to in Gogs

CVSS 5.4

CVE-2026-13163 MEDIUM

Lack of input validation in Mailerup input parameter leads to Open Redirect

CVE-2026-54588 CRITICAL

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

CVSS 9.6

CVE-2026-47377 MEDIUM

NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin

CVE-2026-53662 CRITICAL

immich: One-click account takeover via XSS in login page continue redirect

CVSS 9.6

CVE-2026-56697 MEDIUM

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

CVSS 6.1

CVE-2026-56326 MEDIUM

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

CVSS 6.1

CVE-2026-44889 MEDIUM

WebOb: Location header normalization during redirect leads to open redirect

CVSS 6.1

CVE-2026-41479 MEDIUM

Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

CVSS 5.4

CVE-2026-54276 MEDIUM

AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

CVSS 6.1

CVE-2026-12863 MEDIUM

Pretix Venueless < d27864a7 - Open Redirect

CVE-2026-12804 MEDIUM

lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect

CVSS 4.3

CVE-2026-56332 MEDIUM

Capgo - Open Redirect via confirmation_url Parameter

CVSS 4.7

CVE-2026-56330 LOW

Capgo - Open Redirect via Unvalidated Stripe Billing URLs

CVSS 3.5

CVE-2026-47645 HIGH

Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

CVSS 8.8

CVE-2026-12622 MEDIUM

Microchip GridTime 3000 1.0r0.03-1.1r0.0 - Password Reset Open Redirect

CVSS 5.4