CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

DEBIAN-CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

UBUNTU-CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations. Mitigation Fixed on upstream master branch...

EUVD-2026-74947

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4unicodeci database collation t...

Linux Distros Unpatched Vulnerability : CVE-2026-87876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribu...

PT-2026-89100

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-85600: Improper Neutralization of Input During Web Page Generation

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

PT-2026-86456

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An argument-handling flaw exists in the SSH login path when usernames begin with a prohibited character. This allows an...

GO-2026-6279 Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server...

PT-2026-82028

Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server...

IBM Langflow OSS arbitrary directory deletion vulnerability

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a vulnerability related to arbitrary directory deletion. This vulnerability stems from its failure to properly validate the username field. Attackers can exploit this...

CVE-2026-7658

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-7658

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

EUVD-2026-53553

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-7658 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-7658

CVE-2026-7658 affects IBM Langflow OSS 1.0.0–1.10.3. The flaw arises from improper validation of the username field, enabling attackers to inject path traversal sequences and bypass containment checks. This can lead to severe impacts such as arbitrary directory deletion, cross-tenant data destruc...