CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity Program Code Python admission webhook + exploit !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES ...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

GHSA-R3H5-4585-7X3W Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Summary The /image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems such as Linux, a directory whose path differs from the...

EUVD-2026-124748

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems...

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Summary The /image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems such as Linux, a directory whose path differs from the...

npm: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

npm: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems vulnerability discovered by ? in WordPress npm astro versions = 5.14.3, = 7.4.6...

CVE-2026-126364

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126364: withastro astro: Astro is a web framework for content-driven websites

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126364 Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126364

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126364 Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-126364

The Astro web framework (versions 5.14.3 through 7.4.7) contains a vulnerability in the /_image endpoint of the @astrojs/node adapter. The issue stems from a failure to preserve case sensitivity when comparing requested local-image paths against the build output directory on case-sensitive filesy...

CVE-2026-68548

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes /admin, /repo, /data with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On...

CLEANSTART-2026-JX34186 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

CVE-2025-27636-Practical-Lab

🛡️ CVE-2025-27636 — Practical Exploitation Lab for Apache Camel 🔍 Overview CVE-2025-27636 is a critical Remote Code Execution RCE vulnerability in Apache Camel , specifically in the camel-exec component. It stems from a subtle but dangerous issue: TheDefaultHeaderFilterStrategy performs...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW A POC for CVE-2024-32002 demonstrating arbitrary write into the .git directory. See cve-2024-32002-submodule-aw for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines th...

CVE-2026-85287

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can regist...

CVE-2026-73856

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is...