GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

CVE-2026-90543

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via...

CVE-2026-44319 free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications, the notifier calls NnefPFDmanagementNotify... and on any delivery error...

CVE-2024-49782

IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification...

CVE-2015-5909

CVE-2015-5909 affects the IDE Xcode Server component of Apple Xcode prior to 7.0. The root cause is insufficient access restriction on repository email lists, allowing a remote, unauthenticated attacker to obtain potentially sensitive build information via incorrect notification delivery. Impact ...

CVE-2015-5909

IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery...

CVE-2015-5909: Exposure of Sensitive Information to an Unauthorized Actor

IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery...