CVE-2026-38527

creationtimestamp| type| source ---|---|--- 2026-04-14 16:46:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjhtgdu6nh2u 2026-04-14 17:07:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjhulnqatj2z...

JLSEC-2026-115 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Summary A prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing for...

CLEANSTART-2026-FH63386 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Multiple security vulnerabilities affect the sealed-secrets package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. See references for individual vulnerability...

SUSE CVE-2026-32884

Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by t...

Security Bulletin: vulerability in IBM Spectrum Symphony with spring framework

Summary vulerability in IBM Spectrum Symphony with spring framework Vulnerability Details CVEID:CVE-2024-38820 DESCRIPTION: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could...

CVE-2025-5804

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a through 1.0.4...

CVE-2026-40042

creationtimestamp| type| source ---|---|--- 2026-04-13 19:22:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjflokkgyi27 2026-04-13 20:25:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjfp747htk2r 2026-04-13 21:22:40+00:00| seen|...

CVE-2026-33810

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2026-34861

creationtimestamp| type| source ---|---|--- 2026-04-13 07:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjed4rvgs62t...

BIT-GOLANG-2026-33810 Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the...

PT-2026-32425

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the...

Conflict-Aware Robust Design for Covert Wireless Communications

Covert wireless communication aims to establish a reliable link while hiding the transmission from an adversary. In wireless settings, uncertainty plays a central role in this tradeoff: it can help mask the signal from a warden, but it also complicates robust system design. This raises a basic...

CVE-2019-25699

creationtimestamp| type| source ---|---|--- 2026-04-12 14:28:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjckridmax2t...

FBI Recovers Deleted Signal Messages Through iPhone Notifications

Signal messages may persist in iPhone notification data, enabling FBI access even after deletion, a court case reveals...

CVE-2026-35537

creationtimestamp| type| source ---|---|--- 2026-04-11 13:05:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj7vmva5fe2e 2026-04-11 13:50:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj7y5gquzy2a...

SUSE CVE-2026-1525

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names e.g., Content-Length and content-length. This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Who is impacted: Applications using...

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

...

CVE-2026-40315

creationtimestamp| type| source ---|---|--- 2026-04-10 19:32:00+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-x783-xp3g-mqhp 2026-04-14 05:18:05+00:00| published-proof-of-concept| Telegram/pSCCNMgE3Fpe3zcCZgeqk6LWYSbZiR1jqFncMFnyrTX8KY 2026-04-14 07:48:06+00:00| seen|...

EUVD-2025-209401

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Case Themes Case Theme User allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a before 1.0.4...

CVE-2025-5804

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a through 1.0.4...