https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:09:45 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-83589 <p>A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.</p> <p>A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-83589 https://vulnerability.circl.lu/vuln/ghsa-8c7h-7vm9-jhj3 <p>A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.</p> <p>A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.</p> https://vulnerability.circl.lu/vuln/ghsa-8c7h-7vm9-jhj3 https://vulnerability.circl.lu/vuln/rhsa-2026:74380 <p>net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints nanoid: nanoid: Denial of Service via infinite loop in random ID generation oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled</p> <p>net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints nanoid: nanoid: Denial of Service via infinite loop in random ID generation oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect oc-mirror__release-4.21: Embedded local cache registry listens on all interfaces without authentication, with delete enabled</p> https://vulnerability.circl.lu/vuln/rhsa-2026:74380