Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

ImpactGiven a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. PatchesThe issue is fixed in...

CVE-2026-57380

creationtimestamp| type| source ---|---|--- 2026-07-13 10:51:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjjj2oxcw2a 2026-07-13 18:59:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkesk5dve2i 2026-07-16 07:55:39+00:00| seen|...

CVE-2026-15546

creationtimestamp| type| source ---|---|--- 2026-07-13 09:45:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfuhyoop2s 2026-07-13 10:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjhn4vufb26 2026-07-14 01:14:35+00:00| seen|...

PT-2026-59484

Content removed...

PT-2026-59197

Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlab git/handlers.py:91 to enforce the admin-configured excluded paths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive...

PT-2026-59657

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

CVE-2026-15483

creationtimestamp| type| source ---|---|--- 2026-07-12 07:31:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqgnujj7nz2t 2026-07-12 07:37:48+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqgoai35gk2m 2026-07-12 07:37:49+00:00| seen|...

CVE-2026-1667

creationtimestamp| type| source ---|---|--- 2026-07-10 22:50:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdacfneqy2i 2026-07-11 00:14:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdezilp4u2y 2026-07-11 00:54:12+00:00| seen|...

CVE-2026-55170

A flaw was found in OpenFGA, an authorization/permission engine. When using MySQL as the datastore, and authorization decisions depend on case-sensitive user strings, the system may incorrectly treat case-distinct values e.g., 'user:Alice' and 'user:alice' as equivalent. This can lead to improper...

CVE-2026-15026

creationtimestamp| type| source ---|---|--- 2026-07-10 12:12:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4nfrcot2a 2026-07-10 21:07:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2ki4go22e...

CVE-2026-13347

creationtimestamp| type| source ---|---|--- 2026-07-10 11:16:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbzis5yut2y 2026-07-10 12:15:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-13347 2026-07-12 18:01:08+00:00| seen|...

CVE-2026-28564

creationtimestamp| type| source ---|---|--- 2026-07-10 10:58:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyj7nlat2y 2026-07-10 12:15:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28564 2026-07-10 13:10:06+00:00| seen|...

CVE-2026-21045

creationtimestamp| type| source ---|---|--- 2026-07-10 08:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbpamuqba27 2026-07-10 09:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbux2ewhl2e 2026-07-10 12:46:38+00:00| seen|...

CVE-2026-54528

A flaw was found in JupyterLab Git, a Git extension for JupyterLab. This vulnerability allows an authenticated user on a case-insensitive filesystem to bypass administrator-configured excluded paths by varying the case of the URL path segment. This bypass enables the user to read file content, vi...

CVE-2026-15300

creationtimestamp| type| source ---|---|--- 2026-07-10 05:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbfirxvof2v 2026-07-10 06:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116894153133982870 2026-07-10 06:00:28+00:00| seen|...

EUVD-2026-34014

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering...

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller,...

GHSA-9M9W-GXF7-RH8M Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

Summary Tesla.Middleware.FollowRedirects is meant to strip the Authorization header when following a cross-origin redirect, but performs the check with a case-sensitive comparison against the lowercase string "authorization". Because Tesla preserves header keys exactly as supplied by the caller,...

Linux Distros Unpatched Vulnerability : CVE-2026-55170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely ...

CVE-2026-4653

creationtimestamp| type| source ---|---|--- 2026-07-09 23:07:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqs2htoe2y 2026-07-09 23:07:28+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaqs2m7yb27...