CVE-2026-96892Medium· 4.3▾ TwilightPoC availableA flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66414Medium· 6.1Leantime Open Redirect in Login Controller via redirectUrl Parameter
CVE-2026-96773Medium· 4.3A weakness has been identified in Intelliants Subrion CMS up to 4.2.1
CVE-2026-82274Medium· 4.7Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL
CVE-2026-54915Medium· 5.4Tautulli is a Python based monitoring and tracking tool for Plex Media Server
CVE-2026-94216Medium· 4.3A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717
CVE-2026-94214Medium· 4.3A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717