OESA-2026-4009 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

CVE-2026-15806 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-15806 vulnerabilities

Vulnerabilities for packages: python...

Linux Distros Unpatched Vulnerability : CVE-2026-15806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take...

CVE-2026-15806

creationtimestamp| type| source ---|---|--- 2026-08-18 16:45:52+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/b4y26ogbuoyvn...

CVE-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

CVE-2026-15806

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

CVE-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

CVE-2026-15806

In Python's urllib.request, HTTPPasswordMgr ignored URL scheme when matching stored credentials, allowing HTTPS credentials to be sent over HTTP if an attacker redirected or downgraded the client, exposing them in cleartext. The fix scopes credential matching by scheme while preserving bare-autho...