5883 matches found
EUVD-2026-48300
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617
The Logto identity and access management platform is vulnerable to principal collision and unauthorized account access due to a lack of string normalization. The software performs strict, unnormalized comparisons on email domains , issuer identifiers , and identity IDs during SSO flows. Because t...
CVE-2026-15617 Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617 Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-15617 Principal/domain lookup without case normalization
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
CVE-2026-65911
In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...
CVE-2026-14282
creationtimestamp| type| source ---|---|--- 2026-07-23 13:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcyizk2jv2i 2026-08-13 03:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97797 2026-08-14 00:00:09+00:00| published-proof-of-concept|...
EUVD-2026-48273
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...
PYSEC-2026-3466 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Header| Field | Value ||---|---|| Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 || Project | Flask-Reuploaded flaskuploads || Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correctname-override...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...
CVE-2026-16631
creationtimestamp| type| source ---|---|--- 2026-07-23 01:46:33+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbpqjfxpt24...
CVE-2026-15617: Improper Handling of Case Sensitivity
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities...
PT-2026-64021
Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...
CVE-2025-50329
creationtimestamp| type| source ---|---|--- 2026-07-22 21:57:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbcwop3p223 2026-07-24 20:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg5yaz6be2a...
CVE-2026-44883
creationtimestamp| type| source ---|---|--- 2026-07-22 20:53:03+00:00| seen| https://bsky.app/profile/smit-artem.bsky.social/post/3mrb7dnrzgs2m...
gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName DNS or rfc822Name email constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...