CWE-178

86 vulnerabilities with CWE-178

CVE-2026-40453 CRITICAL

Apache Camel HeaderFilterStrategy - Case-Variant Internal Header Injection

CVSS 9.9

CVE-2026-22665 HIGH

prompts.chat Identity Confusion via Case-Sensitive Username Handling

CVSS 8.1

CVE-2026-33691 MEDIUM

OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

CVSS 6.8

CVE-2026-3532 MEDIUM

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

CVSS 4.2

CVE-2026-32939 HIGH

DataEase is Vulnerable to H2 JDBC RCE Bypass

CVSS 8.1

CVE-2026-28292 CRITICAL

simple-git 3.15.0-3.32.2 - Remote Code Execution

CVSS 9.8

CVE-2026-29054 HIGH

Traefik 2.11.9-2.11.37/3.1.3-3.6.8 - Auth Bypass

CVSS 7.5

CVE-2026-27896 HIGH

modelcontextprotocol/go-sdk < 1.3.1 - JSON-RPC Field Case Sensitivity Bypass via Non-Standard Casing

CVSS 7.5

CVE-2026-27588 CRITICAL

Caddy < 2.11.1 - Host Header Routing Bypass via Case Sensitivity Mismatch

CVSS 9.1

CVE-2026-27587 CRITICAL

Caddy < 2.11.1 - Path-Based Routing Bypass via Case Sensitivity Mismatch

CVSS 9.1

CVE-2026-25889 MEDIUM

filebrowser < 2.57.1 - Authenticated Password Change Bypass via Case Sensitivity Flaw

CVSS 5.4

CVE-2025-67718 HIGH

NPM Formio < 3.5.7 - Information Disclosure

CVE-2025-59944 HIGH

Cursor < 1.6.23 - Remote Code Execution via Case-Sensitive File Protection Bypass

CVSS 8.0

CVE-2025-61593 HIGH

Cursor < 1.7 - Remote Code Execution via CLI Agent File Modification

CVSS 7.1

CVE-2025-50864 MEDIUM

elysiajs/cors < 1.3.1 - Origin Validation Error via Substring Match Bypass

CVSS 6.5

CVE-2025-46701 HIGH

Apache Tomcat <11.0.6 - Security Constraint Bypass

CVSS 7.3

CVE-2025-4035 MEDIUM

Red Hat Enterprise Linux 10 - Cookie Domain Validation Bypass via Case Sensitivity

CVSS 4.3

CVE-2025-27636 MEDIUM

Apache Camel <4.10.2 - Command Injection

CVSS 5.6

CVE-2024-6866 HIGH

corydolphin/flask-cors <4.01 - SSRF

CVSS 7.5

CVE-2024-55634 HIGH

Drupal 8.0.0-10.2.10, 10.3.0-10.3.8, 11.0.0-11.0.7 - Privilege Escalation

CVSS 8.1

CVE-2024-38829 LOW

Spring LDAP <3.2.7 - Info Disclosure

CVSS 3.7

CVE-2024-38820 LOW

Spring Framework 5.3.0-5.3.40 and 6.1.0-6.1.13 - Case Sensitivity Bypass in DataBinder DisallowedFields

CVSS 3.1

CVE-2024-5699 CRITICAL

Firefox < 127.0 - Cookie Prefix Bypass via Case Sensitivity Mismatch

CVSS 9.8

CVE-2024-32879 MEDIUM

Python Social Auth <5.4.1 - Info Disclosure

CVSS 4.9

CVE-2024-23331 HIGH

vite 2.7.0-2.9.17 - Improper Access Control via Case-Insensitive Filesystem Bypass

CVSS 7.5