https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:47:41.256828+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2018-25091 CVE-2018-25091 2026-10-10T18:47:41.262618+00:00

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive).

 https://cve.radiocsirt.org/vuln/usn-6473-1 USN-6473-1 — python-urllib3 vulnerabilities 2026-10-10T18:47:41.262677+00:00

Affected: Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-urllib3

It was discovered that urllib3 didn't strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-25091)

It was discovered that urllib3 didn't strip HTTP Cookie header on cross-origin redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-43804)

It was discovered that urllib3 didn't strip HTTP body on status code 303 redirects under certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2023-45803)