SUSE CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

EUVD-2026-69243

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

EEF-CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Summary Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

PT-2026-84264

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 Description Improper handling of case sensitivity in the inets httpd component allows a remote unauthenticated attacke...

BIT-KEYCLOAK-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier URI validation. This is achieved by registering a malicious client with a...

CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry

Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.7 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...

CVE-2026-18356: Incomplete List of Disallowed Inputs

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

PT-2026-79371

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded versions prior to 3.3.5 Description The plugin fails to perform case-insensitive comparisons when checking logins against the username denylist and does not consider the account email address. This allows blocked...

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...

GHSA-VWG3-W8W3-PC79 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process on case-insensitive filesystems due to the lack of case-insensitive matching fo...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...