CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-62230

Grav

CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

EUVD-2026-45118

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

PT-2026-60640

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description An unauthenticated attacker can bypass restrictions on sensitive file types by requesting files with uppercase or mixed-case extensions e.g., .YAML, .PHP. This occurs because the default .htaccess file...

CVE-2026-62230: Improper Handling of Case Sensitivity

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-44019

creationtimestamp| type| source ---|---|--- 2026-07-16 23:08:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqse4yoyu52o...

CVE-2026-57074

creationtimestamp| type| source ---|---|--- 2026-07-16 18:04:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrt4le6bw25 2026-07-17 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqul65ilha2y 2026-07-18 09:28:03+00:00| seen|...

CVE-2026-62350

creationtimestamp| type| source ---|---|--- 2026-07-15 20:40:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqplfhvrnj2i...

CVE-2026-54563

creationtimestamp| type| source ---|---|--- 2026-07-15 17:17:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7zq7njw22 2026-08-26 16:35:10+00:00| published-proof-of-concept| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

MAL-2026-10626 Malicious code in @react-case/option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

CVE-2026-58475

creationtimestamp| type| source ---|---|--- 2026-07-14 15:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqml5byefk2g...

CVE-2026-15628

creationtimestamp| type| source ---|---|--- 2026-07-14 05:52:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqljbsldb52l 2026-07-19 20:32:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmrci6j52u 2026-07-19 20:36:31+00:00| seen|...

CVE-2026-39492

creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92343 2026-07-14 00:00:19+00:00| seen| https://t.me/GithubRedTeam/92343 2026-07-15 00:00:31+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92343 2026-07-16 19:00:18+00:00| seen|...

SUSE-SU-2026:2924-1 Security update for gnutls

This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...

Security update for gnutls

This update for gnutls fixes the following issues CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...