CVE-2026-47346 TYPO3 CMS - Broken Access Control in Form Framework

Backend users with file write permissions were able to upload form definition files with mixed-case extensions e.g., .FORM.YAML to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to...

CVE-2026-47346

Summary: CVE-2026-47346 affects TYPO3 CMS prior to certain patch versions, where backend users with file write perms can upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass upload restrictions. This can be exploited to execute arbitrary SQL statements and escalate...

CVE-2026-47346 TYPO3 CMS - Broken Access Control in Form Framework

Backend users with file write permissions were able to upload form definition files with mixed-case extensions e.g., .FORM.YAML to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to...

CVE-2026-34033

creationtimestamp| type| source ---|---|--- 2026-06-09 07:32:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mntojwksmd2c...

CVE-2026-47346: Improper Handling of Case Sensitivity

Backend users with file write permissions were able to upload form definition files with mixed-case extensions e.g., .FORM.YAML to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to...

TYPO3 CMS 安全漏洞

TYPO3 CMS is a content management system developed under the TYPO3 open source framework. There is a security vulnerability in TYPO3 CMS, which stems from the upload limit imposed on form definition files. This limit can be bypassed by using mixed uppercase and lowercase file extensions, allowing...

CVE-2026-42536

creationtimestamp| type| source ---|---|--- 2026-06-08 22:00:24+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnsolmbovy2r 2026-06-08 23:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnsrxlori626 2026-06-09 00:51:01+00:00| seen|...

Important: tomcat

Issue Overview: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are...

Important: tomcat10

Issue Overview: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are...

Important: tomcat9

Issue Overview: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are...

PT-2026-50588

Name of the Vulnerable Software and Affected Versions OpenSlide versions 3.4.1 through 4.0.0 Description The parse level0 xml function in src/openslide-vendor-ventana.c fails to properly validate row or column tile counts when processing crafted Ventana BIF files. By providing nonpositive counts,...

MINI-Q6X3-GG7F-2JH6

Bulletin has no description...

PT-2026-50581

Name of the Vulnerable Software and Affected Versions HTML::Gumbo versions prior to 0.19 Description Type confusion occurs when the walk tree function in lib/HTML/Gumbo.xs fails to properly handle the element. This element is incorrectly treated as a text node, causing strlen to over-read the hea...

BIT-DJANGO-2026-8404 Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their...

Exploit for CVE-2026-48595

CVE-2026-48595 - elixir-tesla tesla Vulnerability Quick Us...

CVE-2026-7565

creationtimestamp| type| source ---|---|--- 2026-06-06 04:39:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnltjbl3h62d 2026-06-12 16:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mo457oewae2b 2026-09-08 16:15:15+00:00| seen|...

PT-2026-60901

Name of the Vulnerable Software and Affected Versions Flask-Reuploaded versions prior to 1.5.1 Description An issue exists in the UploadSet.save function where the name parameter can be used to bypass extension denylists. When a user provides a name override, the system performs re-validation usi...

EulerOS Virtualization 2.12.0 : glib2 (EulerOS-SA-2026-2099)

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line...

EulerOS Virtualization 2.10.0 : glib2 (EulerOS-SA-2026-2046)

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types...

CVE-2026-43513

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks. Mitigation This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using...