vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

UBUNTU-CVE-2026-12547

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

CVE-2026-12547 Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2755)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

TencentOS Server 3: python3.12-urllib3 (TSSA-2026:0623)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0623 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-54171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following...

CVE-2026-44979 @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing...

CVE-2026-54171

Excon CVE-2026-54171 concerns the RedirectFollower middleware in Ruby’s Excon prior to v1.5.0, which failed to redact additional sensitive headers when following redirects. The issue could allow leakage of header data from the initial request to the redirected target. A fix is available in v1.5.0...

PT-2026-60650

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16 Description The plugin accepts JWT JSON Web Token access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes...

CVE-2026-15075

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

Linux Distros Unpatched Vulnerability : CVE-2026-49853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only...

SUSE-SU-2026:3033-1 Security update for perl-libwww-perl

This update for perl-libwww-perl fixes the following issue - CVE-2026-8368: LWP: UserAgent: Authorization and Proxy-Authorization headers are leaked on cross-origin redirects bsc1265156...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 1.0 to provide HTTP client functionality for Python applications. Multiple vulnerabilities affect urllib3. CVE-2026-44431 involves exposure of sensitive information where cross-origin redirects followed through the low-level ProxyManager AP...

SUSE-SU-2026:2962-1 Security update for perl-libwww-perl

This update for perl-libwww-perl fixes the following issue - CVE-2026-8368: LWP: UserAgent: Authorization and Proxy-Authorization headers are leaked on cross-origin redirects bsc1265156...

CVE-2026-15075

CVE-2026-15075 affects Eclipse Vert.x up to 4.5.29 (4.x) and 5.1.4 (5.x). The DefaultRedirectHandler in vertx-core forwards all request headers across cross-origin HTTP 30x redirects, stripping only Content-Length. No origin check is performed before copying headers to the redirect target. This a...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

Security Bulletin: Vulnerability in follow-redirects bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion and IBM Fusion HCI include the follow-redirects library, which is affected by an information exposure vulnerability. CVE-2026-40895 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules...

GHSA-48RX-C7PG-Q66R Excon does not redact additional sensitive/risky headers when following redirects

Impact The redirect follower middleware previously failed to strip a number of headers that are known to be sensitive and did not provide a way to provide a custom list of headers to strip. What kind of vulnerability is it? Who is impacted? This could cause inadvertent leakage of sensitive data f...

SUSE CVE-2026-8927

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed...