5883 matches found
CVE-2026-62230 Grav < 2.0.4 File Access Bypass via Case Variation
Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...
PT-2026-60640
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description An unauthenticated attacker can bypass restrictions on sensitive file types by requesting files with uppercase or mixed-case extensions e.g., .YAML, .PHP. This occurs because the default .htaccess file...
CVE-2026-62230: Improper Handling of Case Sensitivity
Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...
CVE-2026-44019
creationtimestamp| type| source ---|---|--- 2026-07-16 23:08:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqse4yoyu52o...
CVE-2026-57074
creationtimestamp| type| source ---|---|--- 2026-07-16 18:04:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrt4le6bw25 2026-07-17 20:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqul65ilha2y 2026-07-18 09:28:03+00:00| seen|...
CVE-2026-62350
creationtimestamp| type| source ---|---|--- 2026-07-15 20:40:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqplfhvrnj2i...
CVE-2026-54563
creationtimestamp| type| source ---|---|--- 2026-07-15 17:17:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7zq7njw22 2026-08-26 16:35:10+00:00| published-proof-of-concept| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp...
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
MAL-2026-10626 Malicious code in @react-case/option (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...
CVE-2026-58475
creationtimestamp| type| source ---|---|--- 2026-07-14 15:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqml5byefk2g...
CVE-2026-15628
creationtimestamp| type| source ---|---|--- 2026-07-14 05:52:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqljbsldb52l 2026-07-19 20:32:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmrci6j52u 2026-07-19 20:36:31+00:00| seen|...
CVE-2026-39492
creationtimestamp| type| source ---|---|--- 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92343 2026-07-14 00:00:19+00:00| seen| https://t.me/GithubRedTeam/92343 2026-07-15 00:00:31+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/92343 2026-07-16 19:00:18+00:00| seen|...
SUSE-SU-2026:2924-1 Security update for gnutls
This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...
Security update for gnutls
This update for gnutls fixes the following issues CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...
PYSEC-2026-2551 Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
Summaryjupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesystem...
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
ImpactGiven a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. PatchesThe issue is fixed in...
PYSEC-2026-2539 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesyste...