CVE-2026-24328 is a medium-severity vulnerability in the SAP Business Server Pages Application (TAF_APPLAUNCHER) that allows unauthenticated attackers to craft malicious URLs causing victims to be redirected to attacker-controlled sites. This URL redirection flaw (CWE-601) requires user interaction (clicking the link) and can lead to limited confidentiality and integrity impacts by exposing or altering sensitive information in the victim's browser context. There is no impact on application availability. The vulnerability affects specific versions of SAP ST-PI components and has a CVSS score of 6.1. No known exploits are currently reported in the wild. European organizations using affected SAP versions should prioritize patching and implement strict URL validation and user awareness to mitigate risks. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP are most likely to be impacted.
CVE-2026-24323 is a medium severity vulnerability in the SAP Document Management System that allows unauthenticated attackers to perform URL redirection to untrusted sites via insufficiently sanitized URL parameters. This vulnerability enables injection of malicious scripts that execute in victims' browsers when they access crafted URLs, impacting confidentiality and integrity with no effect on availability. Exploitation requires user interaction but no authentication, and the vulnerability affects multiple SAP_APPL and S4CORE versions widely used in enterprise environments. There are no known exploits in the wild yet, and no patches have been published at the time of disclosure. European organizations using affected SAP versions are at risk of targeted phishing or social engineering attacks leveraging this flaw. Mitigation involves careful input validation, user awareness, and monitoring for suspicious URL usage. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP systems are most likely to be impacted.
The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated redirect to the attacker-controlled domain and subsequently download the malicious content. This vulnerability has a high impact on the confidentiality and integrity of the application, with no effect on the availability of the application.
CVE-2026-0484 is a medium-severity vulnerability in SAP NetWeaver Application Server ABAP and SAP S/4HANA that allows an authenticated attacker with limited privileges to exploit a missing authorization check. This flaw enables modification of text data within the system, impacting data integrity without affecting confidentiality or availability. The vulnerability arises from improper validation related to URL redirection (CWE-601) and affects multiple SAP_BASIS versions from 700 through 816. Exploitation requires authentication but no user interaction, and no known exploits are currently reported in the wild. The vulnerability's impact is primarily on the integrity of application data, which could lead to unauthorized changes in business-critical information. European organizations using affected SAP versions are at risk, especially those with extensive SAP deployments in finance, manufacturing, and supply chain sectors. Mitigation requires applying SAP patches once available and implementing strict access controls and monitoring of transaction codes. Countries with significant SAP market penetration and critical infrastructure relying on SAP, such as Germany, France, and the UK, are most likely to be affected. The CVSS score of 6.5 reflects a medium severity due to the integrity impact and the need for authenticated access.
CVE-2025-66596 is an open redirect vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The product fails to properly validate the Host header in HTTP requests, allowing attackers to craft malicious URLs that redirect users to untrusted, potentially harmful websites without user interaction or authentication. This vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. While no known exploits are currently reported in the wild, exploitation could facilitate phishing or social engineering attacks by leveraging trusted FAST/TOOLS URLs. European organizations using FAST/TOOLS in critical industrial control systems could face reputational damage and increased risk of secondary attacks. Mitigation requires strict validation of Host headers, applying vendor patches when available, and monitoring for suspicious redirects.
client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certificate-auth contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated Host header, allowing an attacker to redirect users to arbitrary domains. This vulnerability is fixed in 1.0.0.
CVE-2026-25149 is an Open Redirect vulnerability in QwikDev's Qwik JavaScript framework versions prior to 1.19.0. The flaw exists in Qwik City's default request handler middleware, allowing attackers to redirect users to arbitrary protocol-relative URLs. Exploiting this vulnerability enables attackers to craft phishing links that appear to originate from trusted domains but redirect victims to malicious sites. The vulnerability has a low CVSS score of 2.7 and does not require user interaction or authentication. Although no known exploits are currently in the wild, unpatched systems remain at risk. The issue was patched in version 1.19.
CVE-2026-24052 is a high-severity open redirect vulnerability in anthropics' Claude Code agentic coding tool prior to version 1.0.111. The flaw arises from improper URL validation using a startsWith() check, allowing attacker-controlled domains like modelcontextprotocol.io.example.com to bypass trusted domain verification. This can cause automatic WebFetch requests to malicious domains without user consent, potentially leading to data exfiltration. No authentication or privileges are required to exploit this vulnerability, but user interaction is needed. The issue has been patched in version 1.
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
CVE-2026-23730 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict this parameter, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trusted WeGIA domain. The vulnerability has a medium severity score of 4.8 and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23729 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict the nextPage parameter, enabling attackers to redirect users to arbitrary external sites. This vulnerability can be exploited for phishing, credential theft, malware distribution, and social engineering by leveraging the trusted WeGIA domain. The vulnerability has a CVSS score of 4.8 (medium severity) and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23728 is an Open Redirect vulnerability in the WeGIA web manager for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the /WeGIA/controle/control.php endpoint via the nextPage parameter when used with metodo=listarTodos and nomeClasse=DestinoControle, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trusted WeGIA domain. The vulnerability requires no authentication but does require user interaction to follow the malicious link. It has a CVSS score of 4.8, indicating medium severity, and has no known exploits in the wild. The issue is fixed in version 3.
CVE-2026-23727 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict this parameter, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering attacks leveraging the trusted WeGIA domain. The vulnerability has a medium severity score of 4.8 and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23726 is an Open Redirect vulnerability in the WeGIA web management application for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the /WeGIA/controle/control.php endpoint via the nextPage parameter when used with specific query parameters, allowing attackers to redirect users to arbitrary external sites. This vulnerability can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trust users place in the legitimate WeGIA domain. The vulnerability has a CVSS score of 4.8 (medium severity) and does not require authentication but does require user interaction. No known exploits are currently reported in the wild. The issue is fixed in version 3.
Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.
Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application. Confidentiality and availability are not impacted.
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.
Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.
