{"schema_version":"1.0","report_date":"2026-10-22","generated_at":"2026-10-22T15:11:23.434409+09:00","quality":"OK","source_count":13,"observed_total":5541,"catalog_total":250,"filtered_total":3,"page":1,"limit":20,"has_next":false,"items":[{"cves":[],"epss":null,"id":"CVE-2026-91403","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.","technologies":[{"group":"vendor","id":"oracle","label":"Oracle"},{"group":"runtime","id":"java","label":"Java"}],"title":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91403"},{"cves":[],"epss":null,"id":"GHSA-4fpj-g9jf-9rgg","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connectio","technologies":[{"group":"runtime","id":"java","label":"Java"},{"group":"os","id":"android","label":"Android"}],"title":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","url":"https://github.com/advisories/GHSA-4fpj-g9jf-9rgg"},{"cves":[],"epss":null,"id":"GHSA-qw47-mcm5-934w","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server","technologies":[{"group":"runtime","id":"java","label":"Java"}],"title":"A2A Java SDK has a fail-open default task authorization","url":"https://github.com/advisories/GHSA-qw47-mcm5-934w"}],"caution":"Only the verified public snapshot's current item set is provided. This endpoint is not an exhaustive CVE archive."}