Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by req...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker t

历史摘要 · 未重新核验 · NVD

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

CVE-2026-83612

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-bet

历史摘要 · 未重新核验 · OSV.dev

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a craft...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash app

历史摘要 · 未重新核验 · NVD

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash app

历史摘要 · 未重新核验 · OSV.dev

Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restr...

CVE-2026-78959

Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker le

历史摘要 · 未重新核验 · NVD

Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacke...

CVE-2026-59335

Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint i

历史摘要 · 未重新核验 · NVD

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

CVE-2026-62673

## Summary The default `.htaccess` shipped with Grav (and the reference `webserver-configs/htaccess.txt`) contains secu

历史摘要 · 未重新核验 · GitHub Advisory

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules

历史摘要 · 未重新核验 · NVD

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are e...

CVE-2026-72836

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership duri

历史摘要 · 未重新核验 · NVD

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/...

CVE-2026-73416

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

历史摘要 · 未重新核验 · NVD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocke...

CVE-2026-72721

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChec

历史摘要 · 未重新核验 · NVD

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.op...

CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules

历史摘要 · 未重新核验 · NVD

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups...

CVE-2026-70429

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistent

历史摘要 · 未重新核验 · NVD

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

CVE-2026-50559

Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces `blocked_extensions_uris` by comparing the requested install name to blockl

历史摘要 · 未重新核验 · GitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`Ope...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public

历史摘要 · 未重新核验 · NVD

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

CVE-2026-54567

## 1. Header | Field | Value | |---|---| | **Title** | Extension-denylist bypass via case-folding asymmetry in name-ove

历史摘要 · 未重新核验 · GitHub Advisory

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose...

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access t

历史摘要 · 未重新核验 · GitHub Advisory

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack th...

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access t

历史摘要 · 未重新核验 · NVD

Grav < 2.0.4 File Access Bypass via Case Variation

CVE-2026-62230

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access t

历史摘要 · 未重新核验 · OSV.dev