PT-2026-92404

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

GHSA-2XMM-M4WV-3FJH October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbi...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint servers. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added. In the affected versions of LibreOffice, a link in a browser using that scheme could contain an embedd...

Astra Linux – Vulnerability in Pypy

In Python 2.x through 2.7.16, urllib supports the localfile scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs. This is demonstrated by triggering a urllib.urlopen'localfile:///etc/passwd' call...

Astra Linux – Vulnerability in Thunderbird, Firefox

A website could have obscured the full-screen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbi...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid before version 4.15 and 5.x before version 5.0.6. Due to a buffer-management bug, it allows for a denial of service. When resolving a request using the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that...

Astra Linux – Vulnerability in HAPProxy

A issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. This issue does not ensure that the scheme and path portions of a URI contain the expected characters. For example, the authority field as observed on a target HTTP/2 server might differ from what the...

PT-2026-91744

Name of the Vulnerable Software and Affected Versions Takahe versions prior to 0.11.1 Description The software fails to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote actors to inject javascript: links. When clicked, these malicious link...

BIT-PYTHON-MIN-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

BIT-PYTHON-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

BIT-LIBPYTHON-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

PYSEC-2026-3844 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...

EUVD-2026-69653

SVGO: removeScripts allows executable links through namespace and control-character bypasses...

GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

python: Python: Information disclosure due to incorrect URL scheme matching

A flaw was found in Python. The HTTPPasswordMgr class in the urllib.request module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS secure connection to be sent over an unencrypted HTTP connection to...

python: Python: Information disclosure due to incorrect URL scheme matching

A flaw was found in Python. The HTTPPasswordMgr class in the urllib.request module did not correctly consider the URL scheme when matching stored credentials against a requested URL. This allowed credentials intended for an HTTPS secure connection to be sent over an unencrypted HTTP connection to...