CVE-2026-54528 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase in GitHandler.prepare in jupyterlabgit/handlers.py to enforce excludedpaths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded...

CVE-2026-59923

creationtimestamp| type| source ---|---|--- 2026-07-08 19:18:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tk2fuhz2t 2026-07-20 22:35:29+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-8c25-4j27-2rv3...

CVE-2026-11903

creationtimestamp| type| source ---|---|--- 2026-07-08 17:37:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5nvsx5n62g 2026-07-08 20:15:14+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-678 2026-07-09 11:30:31+00:00| seen|...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and earlier, the CUPS daemon cupsd contained a authorization bypass vulnerability due to case-insensitive username comparisons during authorization checks. This vulnerability...

CVE-2026-9731

creationtimestamp| type| source ---|---|--- 2026-07-08 08:19:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4oojt3zg2z...

CVE-2026-53751

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

CVE-2026-53751

CVE-2026-53751 affects DataEase prior to 2.10.24. The vulnerability arises from the H2 database JDBC URL validation being bypassable by Unicode characters whose case-conversion behavior differs between DataEase’s validation and H2 parsing, enabling an attacker to smuggle dangerous parameters (e.g...

CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

CVE-2026-48062

creationtimestamp| type| source ---|---|--- 2026-07-07 18:06:56+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116880021750277483 2026-07-17 21:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquojfihof2j 2026-07-18 09:00:47+00:00| seen|...

CVE-2011-10043

creationtimestamp| type| source ---|---|--- 2026-07-07 17:34:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq35a4wvad2x 2026-07-07 19:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3e7727ll2z 2026-07-08 11:00:04+00:00| seen|...

GO-2026-5819 Authelia has an Edge Case Access Control Rule Mismatch in github.com/authelia/authelia

Authelia has an Edge Case Access Control Rule Mismatch in github.com/authelia/authelia...

PYSEC-2026-1383 Flask-CORS vulnerable to Improper Handling of Case Sensitivity

corydolphin/flask-cors version 5.0.1 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

JLSEC-2026-655 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Summary Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different...

MAL-2026-7975 Malicious code in lcalx0968259 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1931 social-auth-app-django affected by Improper Handling of Case Sensitivity

Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix...

CVE-2026-33264

creationtimestamp| type| source ---|---|--- 2026-07-07 10:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116878227880912732 2026-07-07 10:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq2fkleckz23 2026-07-07 11:38:55+00:00| seen|...

GHSA-473P-56XX-VG67 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)

Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...

CVE-2026-13705

creationtimestamp| type| source ---|---|--- 2026-07-06 16:18:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyikmglvy2z 2026-07-06 17:12:54+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyllcf2ut2c...