Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-85676

Dub Open Redirect via Unrestricted redir_url Parameter

Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dub
Products
Dub
CVE-2026-72552

Dub Dub - Server-Side Request Forgery

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Dub
Products
Dub