CVE-2025-43526

Unauthorized Web API Access via File URL in Safari Lockdown Mode

This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Tahoe Safari

CVE-2026-34283

Interactive Authentication Bypass in Oracle Identity Manager Identity Console

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Identity Manager

CVE-2026-40255

@adonisjs/http-server has an Open Redirect vulnerability

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().back() method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host.An attacker who can influence the Referer header can cause the application to redirect users to a malicious external site. This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back'). This issue has been fixed in versions 7.8.1 and 8.2.0 and 7.4.0 of @adonisjs/core.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Adonisjs

Products

Core Http-core Http-server

CVE-2023-3922

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-6203

User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter

The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpeverest

Products

Wordpress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

CVE-2025-64250

WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a through <= 8.6.6.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Directorist

CVE-2025-68509

WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-68602

WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Scott Paterson Wordpress

Products

Accept Donations With Paypal Wordpress

CVE-2026-39484

WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

John Darrel Wordpress

Products

Hide My Wp Ghost Wordpress

CVE-2025-67587

WordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Crm Perks Wordpress

Products

Wp Gravity Forms Freshdesk Plugin Wordpress

CVE-2025-66062

WordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTube Lyte: from n/a through <= 1.7.28.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-62981

WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.8 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-58204

WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phishing.This issue affects Podlove Podcast Publisher: from n/a through <= 4.2.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-58006

WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Crm Perks Wordpress

Products

Wp Gravity Forms Keap/infusionsoft Wordpress

CVE-2025-54681

WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Phishing.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-49868

WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-49325

WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-47644

WordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-47456

WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-47455

WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—