GHSA-Q3JH-WRC6-JGQ8 follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

npm: follow-redirects array-form headers bypass cross-origin credential stripping

npm: follow-redirects array-form headers bypass cross-origin credential stripping vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, 1.16.1...

EUVD-2026-104536

follow-redirects sensitiveHeaders regex escaping can expose credential headers...

follow-redirects sensitiveHeaders regex escaping can expose credential headers

Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...

GHSA-8R9P-F939-6H3C follow-redirects sensitiveHeaders regex escaping can expose credential headers

Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...

npm: follow-redirects sensitiveHeaders regex escaping can expose credential headers

npm: follow-redirects sensitiveHeaders regex escaping can expose credential headers vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, 1.16.1...

stacs

Static Token And Credential Scanner What is it? STACS is a YARA powered static credential scanner which suports binary file formats, analysis of nested archives, composable rulesets and ignore lists, and SARIF reporting. What does STACS support? Currently, STACS supports recursive unpacking of: 7...

CVE-2026-93222

A flaw was found in the Linux kernel's signal handling subsystem. When dispatching signals to a group of processes across different namespaces, the kernel modified shared signal metadata in place rather than copying it for each recipient. A local user could exploit this behavior to cause recipien...

CVE-2026-111763

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-107755

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to credential disclosure due to insufficient filtering in the _replicator database . An authenticated user can exploit this flaw to read replication credentials belonging to other users' replications, rather than being restri...

CVE-2026-107755 Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765

The A2A Java SDK (official Java SDK for the Agent2Agent Protocol) is vulnerable in versions 1.3.0.Final and prior to 1.3.2.Final . The AndroidA2AHttpClient synchronous POST path improperly overrides the disabled-redirect setting, allowing followRedirects to default to true . This causes the SDK t...

EUVD-2026-105136

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

EUVD-2026-105127

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

CVE-2026-111763 A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When a client application configures credentials through...

CVE-2026-111763

The A2A Java SDK (prior to version 1.3.0.Final ) is vulnerable to credential leakage via HTTP redirects. The AuthInterceptor.intercept component in client/transport/spi/src/main/java/org/a2aproject/sdk/client/transport/spi/interceptors/auth/AuthInterceptor.java uses the APIKeySecurityScheme.name(...