CVE-2026-78145

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-781466.5The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request b CVE-2026-781477.3A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml CVE-2026-781485.3A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggm CVE-2026-781495.3The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its store CVE-2026-78158.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_inde CVE-2026-781502.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing us CVE-2026-781515.3The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in CVE-2026-781525.3The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outp CVE-2026-781535.3The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conte CVE-2026-781559.9privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges CVE-2026-781567.4A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/CVE-2026-781577.4A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component