PT-2026-84085

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.apply constraints/2 lib/ash/type/ci string.ex validated the max length, min length, and...

CVE-2026-83612: Improper Handling of Case Sensitivity

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

CVE-2026-84303: Improper Handling of Case Sensitivity

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as...

PT-2026-84376

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1 Description The xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go fails to lowercase header matcher names within the normalizeHeaderMatcher function, despite incoming metadata keys being lowercase...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

CVE-2026-82726 AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...

curl: IMAP connection reuse runs requests in the wrong case-sensitive mailbox

When libcurl reuses an authenticated IMAP connection, lib/imap.c:2071-2089 uses curlstrequal to decide whether the requested mailbox is already selected. RFC 9051 section 5.1 requires clients to work with servers where non-INBOX mailbox names are case-sensitive, while only INBOX is guaranteed to ...

Chromium: CVE-2026-78959 Improper handling of case sensitivity in FileSystem

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-4398 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own...

CVE-2026-81817

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...

CVE-2026-81820 Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-81820

Flowintel versions greater than 3.3.0 are vulnerable to HTML injection in the MISP case history timeline. Attacker-controllable MISP object fields (object UUID, name, attribute value, attribute type, comment, first/last seen, and IDS flag) were concatenated directly into HTML strings before rende...

CVE-2026-81753

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-81814

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

EUVD-2026-67123

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...

CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification

Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...