5882 matches found
CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749 CVE-2026-18749
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
CVE-2026-18749
A vulnerability exists in the VinceTrack system where the type=track branch incorrectly authorizes access based only on _is_my_case(t_attach.case) without checking the VinceTrackAttachment.shared status. This flaw allows any case member who possesses or is sent the UUID of a coordinator-uploaded ...
CVE-2026-70429
A flaw was found in Jenkins. Due to inconsistent handling of case sensitivity in user and group names, an attacker with the ability to create new users or groups could exploit this vulnerability. By crafting user or group names that case-insensitively match existing ones, the attacker could...
CVE-2026-18749: Authorization Bypass Through User-Controlled Key
The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
PT-2026-71334
The type=track branch authorises on is my caset attach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...
GO-2026-5287 Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts in github.com/traefik/traefik
Traefik's HTTP/3 TLS configuration selection is vulnerable to a bypass when using wildcard or mixed-case hosts in the SNI. The HTTP/3 QUIC path performed a direct, case-sensitive lookup on the SNI value to select the applicable TLS configuration. This lookup failed to match wildcard host patterns...
PT-2026-76022
Traefik's HTTP/3 TLS configuration selection is vulnerable to a bypass when using wildcard or mixed-case hosts in the SNI. The HTTP/3 QUIC path performed a direct, case-sensitive lookup on the SNI value to select the applicable TLS configuration. This lookup failed to match wildcard host patterns...
CVE-2026-72721
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
CVE-2026-72721
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
EUVD-2026-55657
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
CVE-2026-72721
Findings: CVE-2026-72721 affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The root cause is a case-sensitive comparison in Onebox::DomainChecker.is_blocked?, which compares hostnames and SiteSetting.blocked_onebox_domains entries. This allows an attacker to bypass c...
CVE-2026-72721 Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
EUVD-2026-55455
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...
PT-2026-69861
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Onebox::DomainChecker.is blocked? performs a case-sensitive comparison between...
CVE-2026-72721: Improper Handling of Case Sensitivity
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...
CVE-2026-17510
creationtimestamp| type| source ---|---|--- 2026-08-09 02:31:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2za2ogj6oc6pd 2026-08-12 20:02:27+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3msvwck3zmw2r...