CVE-2026-41513

Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.

• CWE-601

• https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw
• https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41506go-git is an extensible git implementation library written i…7.4
• CVE-2026-41507math-codegen generates code from mathematical expressions. P…9.8
• CVE-2026-41509CROSS implementation contains reference and optimized implem…9.8
• CVE-2026-4151GIMP ANI File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-41511OpenMcdf is a fully .NET / C# library to manipulate Compound…5.5
• CVE-2026-41512ai-scanner is an AI model safety scanner built on NVIDIA gar…9.9
• CVE-2026-41514OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41515OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41516OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41517Emlog is an open source website building system. Prior to ve…0
• CVE-2026-41518Chartbrew is an open-source web application that can connect…7.6
• CVE-2026-41519Weblate is a web based localization tool. Prior to version 5…5.4