CWE-601: Open redirect

1,847 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 40High 211Medium 1,494Low 95Not scored 7

CVEs per yearBy the year they were published

CVE-2012-0518
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect…
Product not named
ExploitedMedium4.7
CVE-2021-38000
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a…
Google · Chrome
ExploitedMedium6.1

CVE-2026-124505
Dianping CAT Login/Logout Handler.java Handler.redirect
Dianping · CAT
Medium5.3
CVE-2026-10844
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM · WebSphere Application Server - Liberty
Medium4.3
CVE-2026-105473
IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS
IBM · QRadar
Medium4.6
CVE-2026-123548
OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
OpenIdentityPlatform · OpenAM
Low2.3
CVE-2026-123547
OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState
OpenIdentityPlatform · OpenAM
Low2.3
CVE-2026-123541
OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
OpenIdentityPlatform · OpenAM
Medium5.3
CVE-2026-17297
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.6
CVE-2026-17291
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.7
CVE-2026-86044
JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
jupyterlab · jupyterlab-desktop
Critical9.6
CVE-2026-35107
HCL AION is affected by multiple security vulnerabilities.
HCL Software · HCL AION
Medium4.7