https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:38:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329676 EUVD-2026-329676 https://cve.radiocsirt.org/vuln/euvd-2026-329676 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53662 <p>immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user&#39;s account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit&#39;s redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich&#39;s origin. The payload then uses the victim&#39;s existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.</p> <p>immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user&#39;s account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit&#39;s redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich&#39;s origin. The payload then uses the victim&#39;s existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53662