CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

EUVD-2026-65466

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

Cross-site Scripting (XSS)

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of the version string from a connected MySQL server. An attacker can execute arbitrary JavaScript code in the context of the application ...

CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

DEBIAN-CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56704

Adminer versions before 5.4.3 are vulnerable to cross-site scripting (XSS) caused by unsanitized database server version strings being inserted into [removed] tags that carry valid CSP nonces. An attacker who controls a rogue MySQL server can return a crafted version string that breaks out of the...

CVE-2026-56704

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-59335: Improper Handling of Case Sensitivity

Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...

CVE-2026-56704: Improper Neutralization of Input During Web Page Generation

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

PT-2026-81131

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

PT-2026-81263

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper handling of case sensitivity in the identity zone authorization check within the Identity Zone Endpoint allows a remote authenticated attacker with zones.write authority to...

Linux Distros Unpatched Vulnerability : CVE-2026-56704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling...

CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry

Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.7 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...

[SECURITY] Fedora 44 Update: python-asyncmy-0.2.14-1.fc44

asyncmy is a fast asyncio MySQL/MariaDB driver, which reuses most of pymysql and aiomysql but rewrites the core protocol with Cython to speed it up...

[SECURITY] Fedora 43 Update: python-asyncmy-0.2.14-1.fc43

asyncmy is a fast asyncio MySQL/MariaDB driver, which reuses most of pymysql and aiomysql but rewrites the core protocol with Cython to speed it up...

AZL-97527 CVE-2026-63381 affecting package mysql for versions less than 8.0.46-2

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...