804 matches found
CVE-2026-107381: Improper Handling of Case Sensitivity
svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences in src/ElementReference/Resolver.php builds the SVG reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes normalizes mixed-case names. An attacker can provide xlink:HrEf on...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130126)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130126 advisory. Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M...
CVE-2026-74041
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...
CVE-2026-74041
Wazuh versions 4.14.3 before 4.14.8 are vulnerable to a remote command validation bypass due to a case-sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector. Authenticated users possessing the manager:update_config privilege can exploit this flaw by injecting an upperca...
CVE-2026-108721
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
EUVD-2026-96995
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
PT-2026-110124
Name of the Vulnerable Software and Affected Versions Open Computer Use versions prior to 1.0.1 Description Improper case sensitivity handling allows local MCP callers to bypass the password-manager denylist by using case-variant bundle identifiers. This enables attackers, including those using...
CVE-2026-108721: Improper Handling of Case Sensitivity
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like...
CVE-2026-105570
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...
CVE-2026-105570: Improper Handling of Case Sensitivity
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...
CVE-2026-89322: Improper Handling of Case Sensitivity
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...
GO-2026-6512 Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
Rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass in github.com/caddyserver/caddy...
EUVD-2026-70998
fastify vulnerable to header validation bypass via incomplete schema case normalization...
CVE-2026-102131 Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and...
Improper Handling of Case Sensitivity
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the web.config or lighttpd.conf configuration files due to case-sensitive access-control deny rules...
CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...
CVE-2026-100580
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...
CVE-2026-100580
The OpenClaw (npm package 'openclaw' ) before version 2026.7.1 contains a vulnerability where the model-facing cron tool improperly handles case sensitivity. A mixed-case payload kind can bypass the agent-facing shell-execution guard and be normalized into a command job. An actor capable of steer...
EUVD-2026-87471
OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...