Rocky Linux 8 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlsa-2025_1917)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251917 advisory. emacs: Shell Injection Vulnerability in GNU Emacs via Custom man URI Scheme CVE-2025-1244 Tenable has extracted the preceding description block directly from the CI...

CLEANSTART-2023-LZ34592 issue was discovered in CHICKEN Scheme through 4

Security vulnerability affects the chicken package. An issue was discovered in CHICKEN Scheme through 4...

EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1777446306)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777446306 advisory. - urllib in Python 2.x through 2.7.16 supports the localfile: scheme, which makes it easier for remote attackers to bypass protection mechanisms...

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Impact fast-uri's mailto scheme parser compares each query field name to the reserved names to, subject, body while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as %74o...

EUVD-2026-88566

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333

The application httpdbg versions prior to 2.2.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the software fails to validate URL schemes for recorded HTTP request URLs displayed as clickable links in its web interface. An attacker who can control the traffic recorde...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-102333 httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers controlling traffic recorded by httpdbg can supply javascript: scheme URLs that execute malicious scripts in the application origin when clicked, allowing...

CVE-2026-100370

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

EUVD-2026-68961

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution...

CVE-2026-100370

The DOMSanitizer library for PHP 7.3+ is vulnerable to an input-validation defect in its isDangerousUrl() method prior to version 1.0.15 . While the sanitizer correctly rejects the "javascript:" scheme, it only rejects the "data:" scheme if the literal substring "onload" is present. This allows a...

HElib

HElib HElib is an open-source Apache License v2.0 software library that implements homomorphic encryption HE. Currently available schemes are the implementations of the Brakerski-Gentry-Vaikuntanathan BGV scheme with bootstrapping and the Approximate Number scheme of Cheon-Kim-Kim-Song CKKS, alon...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF due to non-functional same-origin checks in justinas/nosurf What happened? Am I affected? PoC Patching Acknowledgements What happened? All versions of nosurf before 1.2.0 failed to apply same-origin checks for incoming requests. This happened due to relying on the .URL.Scheme...

CVE-2021-30862

CVE-2021-30862 En 2021, CodeColorist publicó sus escritos sobre las vulnerabilidades Mistuned, una serie de vulnerabilidades que afectan a iTunes Store y permiten la ejecución remota de código con un solo clic. Notablemente, demostró cómo abrir la calculadora sin ninguna corrupción de memoria, so...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

How to Break the Miranda Signature Scheme over Matrix Gabidulin Codes

The Miranda signature scheme relies on masking a matrix code which disposes of a masked underlying structure, and the knowledge of which allows for efficient error decoding. We consider a Gabidulin code which is expanded into a matrix code, that is only \Fq-linear. An additional masking is then...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...