Skip to content
BackEsc
Sign in

CWE-601 · weakness in Open Redirect

Open Redirect

1,777 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
127
likely to be exploited
12

Every one of the 1,777 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a c…CVE-2021-38000Google · CVSS 6.1 · 4.9% likely
  2. Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown…CVE-2012-0518Oracle · CVSS 4.7 · 4.7% likely
  3. Apache Tomcat - Open RedirectCVE-2018-11784Apache Software Foundation · 98% likely
  4. Ruby on Rails - Open Redirect via Host Header InjectionCVE-2021-22881https://github.com/rails/rails · 87% likely
  5. Apache HTTP server v2.4.0 to v2.4.39 - Open RedirectCVE-2019-10098Apache HTTP Server · 74% likely
  6. Open Redirect via Organization SwitchingCVE-2025-6197Grafana · CVSS 4.2 · 70% likely
  7. Revive Adserver <5.1.0 - Open RedirectCVE-2021-22873https://github.com/revive-adserver/revive-adserver · 70% likely
  8. XWiki - Open RedirectCVE-2023-32068xwiki · CVSS 4.7 · 54% likely
  9. Gitea <1.16.5 - Open RedirectCVE-2022-1058go-gitea · CVSS 7.2 · 53% likely
  10. Microsoft OWA Exchange Server 2003 - 'redir.asp' Open RedirectionCVE-2008-154748% likely
  11. Mosparo < 1.0.2 - Open RedirectCVE-2023-5375mosparo · CVSS 4.3 · 39% likely
  12. BlogEngine CMS - Open RedirectCVE-2023-33405CVSS 6.1 · 31% likely
  13. PrivateGPT < 0.5.0 - Open RedirectCVE-2024-5936imartinez · CVSS 4.3 · 30% likely
  14. WordPress Toolbar <= 2.2.6 - Open RedirectCVE-2023-6389WordPress Toolbar · CVSS 6.1 · 27% likely
  15. Nova noVNC - Open RedirectCVE-2021-3654openstack-nova · 27% likely
  16. Django - Open RedirectCVE-2018-1457425% likely
  17. WordPress Pie Register <3.8.2.3 - Open RedirectCVE-2023-0552Registration Forms · CVSS 5.4 · 24% likely
  18. Prometheus - Open RedirectCVE-2021-29622prometheus · CVSS 6.5 · 20% likely
  19. D-Link DIR850 ET850-1.08TRb03 - Open RedirectCVE-2021-4637916% likely
  20. Oracle E-Business Suite 12.1.3/12.2.x - Open RedirectCVE-2017-3528Oracle Corporation · 15% likely
  21. b2evolution CMS <6.11.6 - Open RedirectCVE-2020-2284014% likely
  22. SonicWall SonicOS 7.0 - Open RedirectCVE-2021-20031SonicWall · 13% likely
  23. Novius OS 5.0.1-elche - Open RedirectCVE-2015-535412% likely
  24. PlaceOS 1.2109.1 - Open RedirectionCVE-2021-4182612% likely
  25. Grav < 1.7 - Open RedirectCVE-2020-1152911% likely
  26. Telaen => v1.3.1 - Open RedirectCVE-2013-262111% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in