CVE-2026-93682

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

EUVD-2026-87321

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

CVE-2026-93682

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

CVE-2026-93682

The PHP language is vulnerable to an out-of-bounds read in the HTTP stream wrapper . When following a redirect where the response contains an empty Location header, the redirect code reads one byte past the end of the heap buffer. This allows a malicious server to manipulate the redirect target, ...

CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

EUVD-2026-87086

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

PT-2026-98824

Name of the Vulnerable Software and Affected Versions Wellav WES Emergency Broadcast Terminal WES100 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES270 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES280 versions prior to 08-08-2023 Wellav WES...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

CVE-2026-52622

Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal models WES100 , WES270 , WES280 , and WES290 (versions prior to 08-08-2023) are vulnerable to a remote information disclosure flaw. An attacker can obtain sensitive information by exploiting a vulnerability in the global API req...

CVE-2026-91766: Exposure of Sensitive Information to an Unauthorized Actor

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CVE-2026-93682: Out-of-bounds Read

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

PT-2026-97826

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.18 through 0.1.38 Description A flaw in the SSE Server-Sent Events transport eventSourceInit fetch wrapper located in src/lib/utils.ts allows a remote attacker to obtain sensitive information. Recommendations...

CVE-2026-52001: Exposure of Sensitive Information to an Unauthorized Actor

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

CVE-2026-52001

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

EUVD-2026-86021

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

PT-2026-98291

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a Location header with an empty value. The redirect...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

php: php: Out-of-bounds read via empty HTTP redirect Location header

A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potential...