Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in authorization checks. A user can obtain an authorization decision meant for a different identity by issuing a check for a user string that differs only in letter case from an authorized one,...

OpenFGA Improper Policy Enforcement

Description In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response. Preconditions This applies if the following preconditions are met: 1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive use...

GHSA-CF98-J28V-49V6 OpenFGA Improper Policy Enforcement

Description In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response. Preconditions This applies if the following preconditions are met: 1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive use...

GHSA-J99Q-93C9-H869 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

On case-insensitive filesystems macOS, Windows, PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the .git/.obsidian/nodemodules restriction while the OS opened the real file. On...

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

On case-insensitive filesystems macOS, Windows, PathFilter compiled its deny-list patterns case-sensitively and matched the path verbatim, so names like .Git/config, .GIT/config, or .oBsIdIaN/secrets.md slipped past the .git/.obsidian/nodemodules restriction while the OS opened the real file. On...

CVE-2026-32652

creationtimestamp| type| source ---|---|--- 2026-06-17 18:27:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moiwvvb3cm2j...

CVE-2026-32804

creationtimestamp| type| source ---|---|--- 2026-06-17 17:23:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moitcf5f5w2f 2026-07-23 10:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcnf7csgh2u...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar

Summary IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1...

CVE-2026-32967

creationtimestamp| type| source ---|---|--- 2026-06-17 02:13:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mohagpnqt42x 2026-06-18 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mol2i4sfak24 2026-06-22 00:31:22+00:00| seen|...

PT-2026-50475

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1 Description When NC SECURE ATTACHMENTS is set to true, an authenticated uploader can upload .html or .svg attachments that the browser renders inline from the NocoDB origin instead of forcing a download. This...

PT-2026-50546

Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - Document content. A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has...

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

Summary Two related issues in the token public-only scope enforcement introduced by PR 32204 CVE-2025-68941 fix. A public-only scoped API token can access private organization data. Issue 1: /user/orgs missing checkTokenPublicOnly routers/api/v1/api.go line 1599: go m.Get"/user/orgs", reqToken,...

GHSA-9CR8-Q42Q-G8M7 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Summary There is a critical vulnerability in Traefik's HTTP/3 QUIC TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact,...

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Summary There is a critical vulnerability in Traefik's HTTP/3 QUIC TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact,...

CVE-2025-69113 WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...

CVE-2026-35323

Technical details about CVE-2026-35323 are not provided in the supplied documents. No affected products, vulnerable components, impact, or remediation are specified. Monitor for Oracle security alerts and future updates.

CVE-2026-35315

...

gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName DNS or rfc822Name email constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf...

CVE-2026-12324

creationtimestamp| type| source ---|---|--- 2026-06-16 14:33:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofzdog3of2b 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...

CVE-2026-12330

creationtimestamp| type| source ---|---|--- 2026-06-16 14:25:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofyvbjse52g 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1924 2026-06-17 20:00:00+00:00| seen|...