Monthly
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Unauthenticated file disclosure in Erlang/OTP's inets httpd allows remote attackers on case-insensitive filesystem deployments to read files inside mod_auth-protected directories by requesting them with differently-cased path segments. The flaw spans OTP 17.0 through 29.x (inets 5.10 through 9.7.x) and stems from mod_auth's path-matching regex omitting the caseless flag, causing authentication checks to be silently bypassed when request path casing differs from the configured directory name while the filesystem resolves both to the same file. No public exploit code or active exploitation has been identified at time of analysis, and deployments on case-sensitive filesystems - the default on Linux - are fully unaffected by this vulnerability.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.
Case-sensitivity bypass in Grav's Apache .htaccess rules prior to version 2.0.4 allows unauthenticated remote attackers to retrieve password hashes and security configuration files by requesting uppercase or mixed-case path variants (e.g., `/USER/accounts/admin.yaml`) on case-insensitive filesystems. The protection boundary - Apache mod_rewrite RewriteRule directives blocking access to user/accounts, user/config, user/data, and user/env - fails entirely when the underlying filesystem resolves uppercase URLs to the same protected files that lowercase rules would block. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no user interaction, making it trivially repeatable against eligible deployments.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Authorization gate bypass in Nuxt (npm package, versions 3.21.7-<3.21.10 and 4.4.7-<4.5.1) allows unauthenticated network access to routes protected by appMiddleware auth rules whenever those route-rule keys contain uppercase characters. This is an incomplete fix for CVE-2026-53721: the prior patch case-folded the lookup path before matching route rules, but left the compiled rule keys verbatim, producing a permanent symmetric mismatch that silently drops all app-level protections for any mixed-case route. No public exploit has been identified at time of analysis; however, the vulnerable condition arises automatically in any Nuxt application deriving route rules from PascalCase page files (e.g., pages/Admin.vue) or writing mixed-case routeRules keys explicitly.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Logto versions 1.10.1 through 1.37.1 allows remote attackers to gain unauthorized access to accounts by using email identifiers that differ only in case or Unicode representation, due to missing normalization during principal lookup. An attacker can register or authenticate with a case-variant of a target email and collide with the intended principal, leading to account takeover without user interaction. No active exploitation or public exploit code has been identified, and EPSS indicates low exploitation probability.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Unauthenticated file disclosure in Erlang/OTP's inets httpd allows remote attackers on case-insensitive filesystem deployments to read files inside mod_auth-protected directories by requesting them with differently-cased path segments. The flaw spans OTP 17.0 through 29.x (inets 5.10 through 9.7.x) and stems from mod_auth's path-matching regex omitting the caseless flag, causing authentication checks to be silently bypassed when request path casing differs from the configured directory name while the filesystem resolves both to the same file. No public exploit code or active exploitation has been identified at time of analysis, and deployments on case-sensitive filesystems - the default on Linux - are fully unaffected by this vulnerability.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
JWT signing key replacement in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to fully compromise the entire Cloud Foundry deployment. By exploiting a case sensitivity mismatch between the authorization layer (which performs a case-sensitive string comparison against the literal 'uaa' identifier) and the MySQL persistence layer (which resolves identifiers case-insensitively under its default collation), an attacker submitting 'UAA' or 'Uaa' bypasses the privilege check while the database silently resolves the request against the real system zone record. Exploitation enables overwriting the system zone's JWT signing key, forging tokens claiming admin and administrator scopes, and cascading into full UAA and Cloud Foundry compromise; no public exploit has been identified at time of analysis, though the Changed-Scope CVSS vector and PR:H signal a high-severity, low-noise attack path against MySQL-backed deployments.
Case-sensitivity bypass in Grav's Apache .htaccess rules prior to version 2.0.4 allows unauthenticated remote attackers to retrieve password hashes and security configuration files by requesting uppercase or mixed-case path variants (e.g., `/USER/accounts/admin.yaml`) on case-insensitive filesystems. The protection boundary - Apache mod_rewrite RewriteRule directives blocking access to user/accounts, user/config, user/data, and user/env - fails entirely when the underlying filesystem resolves uppercase URLs to the same protected files that lowercase rules would block. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no user interaction, making it trivially repeatable against eligible deployments.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Authorization gate bypass in Nuxt (npm package, versions 3.21.7-<3.21.10 and 4.4.7-<4.5.1) allows unauthenticated network access to routes protected by appMiddleware auth rules whenever those route-rule keys contain uppercase characters. This is an incomplete fix for CVE-2026-53721: the prior patch case-folded the lookup path before matching route rules, but left the compiled rule keys verbatim, producing a permanent symmetric mismatch that silently drops all app-level protections for any mixed-case route. No public exploit has been identified at time of analysis; however, the vulnerable condition arises automatically in any Nuxt application deriving route rules from PascalCase page files (e.g., pages/Admin.vue) or writing mixed-case routeRules keys explicitly.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Authentication bypass in Logto versions 1.10.1 through 1.37.1 allows remote attackers to gain unauthorized access to accounts by using email identifiers that differ only in case or Unicode representation, due to missing normalization during principal lookup. An attacker can register or authenticate with a case-variant of a target email and collide with the intended principal, leading to account takeover without user interaction. No active exploitation or public exploit code has been identified, and EPSS indicates low exploitation probability.