EUVD-2026-113272

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location...

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location Affected versions and vulnerable location - Confirmed on sigstore-js at 3a83271 current HEAD. - File: packages/oci/src/registry.ts. - signIn installs the credential as a DEFAULT header on the shared...

GHSA-J63V-MWHM-56JX @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location Affected versions and vulnerable location - Confirmed on sigstore-js at 3a83271 current HEAD. - File: packages/oci/src/registry.ts. - signIn installs the credential as a DEFAULT header on the shared...

CVE-2026-118763 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while...

CVE-2026-118763 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while...

CVE-2026-118763

The sigstore-js library (specifically the @sigstore/oci package) is vulnerable to credential leakage in versions prior to 0.7.2 . The issue resides in packages/oci/src/registry.ts, where the RegistryClient.signIn() method stores registry Authorization and Docker configuration headers as defaults ...

CVE-2026-118763: sigstore sigstore-js: sigstore-js provides JavaScript libraries for interacting with Sigstore services

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

curl: netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)

Summary curl's redirect credential-leak protection the CURLOPTUNRESTRICTEDAUTH off-by-default guarantee, enforced by Curlauthallowedtoorigin covers three credential sources: a custom Authorization header, CURLOPTUSERNAME/CURLOPTPASSWORD, and cookies. It does not cover credentials read from a .net...

Cleartext Transmission Of Sensitive Information

AsyncHttpClient is vulnerable to Cleartext Transmission of Sensitive Information. The vulnerability is due to improper handling of cross-host request replay, which allows an attacker to trigger documented retry or failover paths that send the original host's request data, authorization credential...

EUVD-2026-94642

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host...

Linux Distros Unpatched Vulnerability : CVE-2026-107282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1,...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...

CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...