CVE-2026-101914

The @grpc/grpc-js library (versions prior to 1.13.1 and 1.14.1 ) contains an authorization flaw where the exact path matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. This allows a request for a longer service method nam...

cups: OpenPrinting CUPS: Remaining case-insensitive username matching in scheduler side paths (CVE-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876

This CUPS vulnerability (a follow-up to CVE-2026-27447 ) involves two case-insensitive comparisons on request-derived usernames in scheduler side paths outside the main authorization path—specifically in printer ACL validation and private-attribute filtering . The mismatched case handling could a...

CVE-2021-48006

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

EUVD-2021-34876

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

Improper Access Control

Caddy is vulnerable to Improper Access Control. The vulnerability is due to incorrect case-insensitive matching in the HTTP host request matcher when large host lists are configured, allowing attackers to modify the casing of the Host header and bypass host-based routing or associated access...

CVE-2026-27896: Improper Handling of Case Sensitivity

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc...

mrab-regex:fuzz_search: Crash in any_case

Project: https://github.com/mrabarnett/mrab-regex.git Detailed Report: https://oss-fuzz.com/testcase?key=4794978914336768 Project: mrab-regex Fuzzing Engine: libFuzzer Fuzz Target: fuzzsearch Job Type: libfuzzerasanmrab-regex Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7d25ebdb01...

[SECURITY] [DLA 4197-1] python-flask-cors security update

Debian LTS Advisory DLA-4197-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert May 31, 2025 https://wiki.debian.org/LTS Package : python-flask-cors Version : 3.0.9-2+deb11u1 CVE ID : CVE-2024-1681 CVE-2024-6839 CVE-2024-6844 CVE-2024-6866 Debian Bug : 1069764 11009...

CVE-2024-6866

A flaw was found in flask-cors. This vulnerability allows unauthorized origins to access restricted paths, leading to potential data exposure and leaks via case-insensitive request path matching due to improper use of the trymatch function. Mitigation Mitigation for this issue is either not...

SUSE CVE-2019-9169

In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:1705-1)

This update for freeradius-server fixes the following issues: Security issue fixed : - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. bsc1041445 Non security issue fixed : - Fix case insensitive matching in compiled regular expressions bsc1027243 Note...

SUSE-SU-2017:1705-1 Security update for freeradius-server

This update for freeradius-server fixes the following issues: Security issue fixed: - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. bsc1041445 Non security issue fixed: - Fix case insensitive matching in compiled regular expressions bsc1027243...

X2Engine 4.1.7 Unrestricted File Upload

-------------------------------------------------------------------------------- X2Engine = 4.1.7 FileUploadsFilter.php Unrestricted File Upload Vulnerability -------------------------------------------------------------------------------- - Software Link: http://www.x2engine.com/ - Affected...