PYSEC-2026-2551 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

PYSEC-2026-3035 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Summaryjupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesystem...

Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

ImpactGiven a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. PatchesThe issue is fixed in...

PYSEC-2026-2539 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesyste...

CVE-2026-57380

creationtimestamp| type| source ---|---|--- 2026-07-13 10:51:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjjj2oxcw2a 2026-07-13 18:59:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkesk5dve2i 2026-07-16 07:55:39+00:00| seen|...

CVE-2026-15546

creationtimestamp| type| source ---|---|--- 2026-07-13 09:45:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfuhyoop2s 2026-07-13 10:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhn4vufb26 2026-07-14 01:14:35+00:00| seen|...

PT-2026-59657

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

PT-2026-59484

Content removed...

PT-2026-59197

Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlab git/handlers.py:91 to enforce the admin-configured excluded paths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive...

CVE-2026-15483

creationtimestamp| type| source ---|---|--- 2026-07-12 07:31:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqgnujj7nz2t 2026-07-12 07:37:48+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqgoai35gk2m 2026-07-12 07:37:49+00:00| seen|...

CVE-2026-1667

creationtimestamp| type| source ---|---|--- 2026-07-10 22:50:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdacfneqy2i 2026-07-11 00:14:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdezilp4u2y 2026-07-11 00:54:12+00:00| seen|...

CVE-2026-55170

A flaw was found in OpenFGA, an authorization/permission engine. When using MySQL as the datastore, and authorization decisions depend on case-sensitive user strings, the system may incorrectly treat case-distinct values e.g., 'user:Alice' and 'user:alice' as equivalent. This can lead to improper...

CVE-2026-15026

creationtimestamp| type| source ---|---|--- 2026-07-10 12:12:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4nfrcot2a 2026-07-10 21:07:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2ki4go22e...

CVE-2026-13347

creationtimestamp| type| source ---|---|--- 2026-07-10 11:16:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbzis5yut2y 2026-07-10 12:15:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-13347 2026-07-12 18:01:08+00:00| seen|...

CVE-2026-28564

creationtimestamp| type| source ---|---|--- 2026-07-10 10:58:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyj7nlat2y 2026-07-10 12:15:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28564 2026-07-10 13:10:06+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-54528

A flaw was found in JupyterLab Git, a Git extension for JupyterLab. This vulnerability allows an authenticated user on a case-insensitive filesystem to bypass administrator-configured excluded paths by varying the case of the URL path segment. This bypass enables the user to read file content, vi...

CVE-2026-15300

creationtimestamp| type| source ---|---|--- 2026-07-10 05:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbfirxvof2v 2026-07-10 06:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116894153133982870 2026-07-10 06:00:28+00:00| seen|...

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller,...