CVE-2026-80444

MediumCVSS 5.4/10Last modified Sep 23, 2026

Description

URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.

This issue affects AVESİS: from 202608201331 before 202608240351.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-80456.5CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fiCVE-2026-80468.1The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can explCVE-2026-8046210.0A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to CVE-2026-80463Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackeCVE-2026-804644.9Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue CVE-2026-804658.7A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All vCVE-2026-804678.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms tCVE-2026-804698.3An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verificCVE-2026-80477.5The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write.CVE-2026-80486.4The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-emCVE-2026-804884.1The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in aCVE-2026-804895.9Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version
CVE-2026-80444: Medium severity, CVSS 5.4 | Vulnix