Cleartext Transmission Of Sensitive Information

AsyncHttpClient is vulnerable to Cleartext Transmission of Sensitive Information. The vulnerability is due to improper handling of cross-host request replay, which allows an attacker to trigger documented retry or failover paths that send the original host's request data, authorization credential...

EUVD-2026-94642

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host...

Linux Distros Unpatched Vulnerability : CVE-2026-107282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...

CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

CVE-2026-92420

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions before 1.2.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to verify that a booking belongs to the requesting user when performing actions on two specific booking endpo...

CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion vulnerability

Hydra Host+ Cross-Host Account Modification and Deletion vulnerability discovered by Stefan Spasic in WordPress Plugin Hydra Booking versions 1.2.4...

WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability

Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Hydra Booking versions 1.2.2...

Astra Linux – Vulnerability in Apache2

In some modssl configurations on the Apache HTTP Server 2.4.35 to 2.4.63, it is possible for trusted clients to bypass access controls using TLS 1.3 session resumption. These configurations are affected when modssl is configured for multiple virtual hosts, with each virtual host restricted to a...

Astra Linux – Vulnerability in Pypy

Python versions 2.7.x through 2.7.16, and 3.x through 3.7.2 are affected by improper handling of Unicode encoding with an incorrect netloc during NFKC normalization. The impact is information disclosure—credentials, cookies, etc., that are cached against a given hostname. The affected components...

CVE-2026-86419: Server-Side Request Forgery (SSRF)

Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In feed processing, redirects were followed without validating the redirect scheme or destination. The original request headers were reused acro...

CVE-2026-85180 Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

CVE-2026-85180 Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

Hurl: Cookies in Cookies section leak when redirecting to a different host

The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...