CVE-2026-12863

MediumCVSS 5.1/10Last modified Jun 23, 2026

Description

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2026
Last modified
Jun 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-128657.1The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attributCVE-2026-128669.8All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScrCVE-2026-128696.1The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard templaCVE-2026-12875.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in colCVE-2026-128729.8The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authCVE-2026-128779.1The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input beforeCVE-2026-128788.8In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.CVE-2026-128795.9An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform alloCVE-2026-12885.5A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer DereferenceCVE-2026-128824.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatcheCVE-2026-128882.0An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling InteCVE-2026-12897.8A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage
CVE-2026-12863: Medium severity, CVSS 5.1 | Vulnix