Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
25 matching advisories · 25 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.9
CVE-2026-19194

CAP JWT claims validation bypass using non-canonical claim names

The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

HashiCorp · Shared library
medium6.5
CVE-2026-128100

Vault vulnerable to ACL deny bypass via case-variant auth method user and group names

Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

HashiCorp · Vault / HashiCorp · Vault Enterprise
high7.6
CVE-2026-126312

OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

openbao · openbao / openbao · openbao
medium6.9
CVE-2026-128048

OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenMage · magento-lts / OpenMage · magento-lts
medium6.3
CVE-2026-126364Some package fixes recorded

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

Recorded fixes — astro: 7.4.7. Check your release branch.

Exploitation not established

npm / @astrojs/nodenpm / astro
critical9.4
CVE-2026-68548

Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

xyproto · algernon
critical9.4
CVE-2026-17409

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium4.1
CVE-2026-17085

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium6.5
CVE-2026-85287

HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

sysadminsmedia · homebox
high8.6
CVE-2026-73856

ModSecurity: Response Body Inspection Bypass

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

owasp-modsecurity · ModSecurity
medium6.3
CVE-2026-63121

Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

kubewarden · policies
high8.1
CVE-2026-109411

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Samba · Samba / Red Hat · Red Hat Enterprise Linux 10
high8.8
CVE-2026-105608

Consul vulnerable to an authorization bypass in service mesh registration

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

HashiCorp · Consul / HashiCorp · Consul Enterprise
high7.1
CVE-2026-116469

MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

MISP · misp-guard
low3.0
CVE-2026-87876

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

Red Hat · Red Hat Hardened Images / Red Hat · Red Hat Enterprise Linux 10
high8.2
CVE-2026-73270

httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Erlang · OTP / Erlang · OTP
medium5.0
CVE-2026-58057

Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity

Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying 'node_options' bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Flowise · Flowise
high7.1
CVE-2026-123012Package fixes recorded

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed.

Recorded fixes — gogs.io/gogs: 0.14.3. Check your release branch.

Public exploit reference

Go / gogs.io/gogs
medium4.0
CVE-2026-123806Package fixes recorded

tuf has platform-dependent delegation path matching

DelegatedRole._is_target_in_pathpattern uses fnmatch.fnmatch to decide whether a given target path is authorized by a delegation's glob pattern.

Recorded fixes — tuf: 7.0.0. Check your release branch.

Exploitation not established

PyPI / tuf
medium6.5
CVE-2026-3833

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

gnutls / Red Hat · Red Hat Enterprise Linux 10
high8.6
CVE-2026-22665

prompts.chat Identity Confusion via Case-Sensitive Username Handling

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

f · prompts.chat
medium4.3
CVE-2025-4035

Libsoup: cookie domain validation bypass via uppercase characters in libsoup

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

Red Hat · Red Hat Enterprise Linux 10 / Red Hat · Red Hat Enterprise Linux 6