780 matches found
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130126)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130126 advisory. Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M...
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...
CVE-2026-74041
Wazuh versions 4.14.3 before 4.14.8 are vulnerable to a remote command validation bypass due to a case-sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector. Authenticated users possessing the manager:update_config privilege can exploit this flaw by injecting an upperca...
running-CVE-2024-32002-locally-for-tesing
We are adapting this for local use we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce How It Works 1. A malicious repository gitrce includes a submodule with a specially crafted path. 2. The submodule path uses a case variation that exploits the...
monstra_cms-3.0.4--getshell
monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE-2018-17418 Code analysis: In line 150 of monstra\plugins\box\filesmanager\filesmanager.admin.php, there is a forbiddentypes variable used as a blacklist restriction. Continue to follow this variable. In the line 150 of...
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
EUVD-2026-96995
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
CVE-2026-89012
CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit for CVE-2026-89012: the forbidden-fields denylist in forgeSQLFromUniversalSearchCriteria introduced with the CVE-2026-71510 fix uses a case-sensitive inarray while the operand charset allows A-Z. Since SQL column resolution is...
CVE-2026-9086-poc
CVE-2026-9086: Keycloak URI Scheme Validation Bypass XSS PoC 日本語版 Overview This repository contains a Proof of Concept PoC for CVE-2026-9086 , a Cross-Site Scripting XSS vulnerability in Keycloak client URI validation. Vulnerable Keycloak versions compared the prohibited javascript: and data:...
CVE-2026-105570
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...
Astra Linux – Vulnerability in Tomcat9
Improper handling of the case sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Older,...
GO-2026-6512 Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
Rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass in github.com/caddyserver/caddy...
EUVD-2026-70998
fastify vulnerable to header validation bypass via incomplete schema case normalization...
CVE-2026-102131 Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and...
Improper Handling of Case Sensitivity
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the web.config or lighttpd.conf configuration files due to case-sensitive access-control deny rules...
EUVD-2026-87471
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...
CVE-2026-100580
The OpenClaw (npm package 'openclaw' ) before version 2026.7.1 contains a vulnerability where the model-facing cron tool improperly handles case sensitivity. A mixed-case payload kind can bypass the agent-facing shell-execution guard and be normalized into a command job. An actor capable of steer...
CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...
CVE-2026-100580
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...