CWE-601: Open redirect
1,825 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 1,825
- Last 12 months
- 539
- Critical
- 37
- Known exploited
- 2
Critical 37High 209Medium 1,480Low 92Not scored 7
CVEs per yearBy the year they were published
- 20203
- 20203
- 20214
- 20224
- 2023150
- 2023135
- 202325
- 2025157
- 2026467
- 2026230
- 2026211
- 2026113
Known exploitedNewest addition to KEV first
- CVE-2012-0518
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect…
Product not named
ExploitedMedium4.7 - CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a…
Google · Chrome
ExploitedMedium6.1
Newest CVEs
- CVE-2026-120638
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
CGI
Not scored - CVE-2026-120636
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form
CGI
Not scored - CVE-2026-120633
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port
CGI
Not scored - CVE-2026-111754
Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
angular · angular
Medium5.1 - CVE-2026-120953
Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
MongoDB · Atlas SQL JDBC Driver
Medium5.1 - CVE-2026-120327
Open Redirection in extension "Mail" (mail)
TYPO3 · Extension "Mail"
Medium5.3 - CVE-2024-12141
Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
WSO2 · WSO2 Identity Server
Medium4.3 - CVE-2024-2372
Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
WSO2 · WSO2 Open Banking AM
Medium5.4 - CVE-2026-118425
Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
Red Hat · Red Hat Build of Keycloak
Medium6.8 - CVE-2026-107020
An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a…
Product not named
High7.5