By weakness (CWE)

CWE-178: related vulnerabilities

CVEs classified under CWE-178. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

11 published vulnerabilities

• CVE-2026-46392HIGH 8.7

  HAX CMS, a platform for managing microsite deployments with PHP or Node.js backends, contains a file upload bypass vulnerability in versions before 26.0.0. The vulnerability stems from a mismatch between how the application validates uploaded file extensions and how its web server security rules apply. An authenticated attacker can upload an HTML file with an uppercase extension (such as .HTML or .HTM) to bypass security controls that normally force downloaded HTML files rather than displayed them inline. Once bypassed, the HTML executes JavaScript within the HAX CMS origin, potentially allowing account compromise, session hijacking, or lateral movement.

• CVE-2026-53721HIGH 8.2

  Nuxt, a popular Vue.js web framework, contains a middleware bypass vulnerability caused by inconsistent case-sensitivity handling between its router and route-rule matcher. An attacker can craft requests with different letter casing to bypass security middleware that should be protecting sensitive routes, potentially exposing functionality that was intended to be restricted. This affects Nuxt versions 3.11.0 through 3.21.6 and 4.0.0 through 4.4.6. Patches are available in versions 3.21.7 and 4.4.7.

• CVE-2026-45062HIGH 8.1

  FrankenPHP, a PHP application server, contains a critical flaw in how it processes file extensions when request paths include non-ASCII characters. Versions 1.11.2 through 1.12.2 are vulnerable to an attack where an attacker can trick FrankenPHP into executing a non-PHP file as if it were PHP code. If your deployment allows file uploads or stores user-controlled content, an attacker could upload a malicious file and then craft a specially-formed URL to trigger code execution on your server. The vulnerability has been fixed in version 1.12.3.

• CVE-2026-45135HIGH 8.1

  Caddy, a popular TLS-enabled web server platform, contains a flaw in its FastCGI request routing logic that could allow an attacker to execute arbitrary code on affected servers. The vulnerability exists when Caddy processes HTTP requests with non-ASCII characters in the path. An attacker who can upload files or control content served through FastCGI can exploit this misconfiguration to trick Caddy into treating non-script files (like images or documents) as executable scripts, leading to remote code execution. The issue affects versions 2.7.0 through 2.11.2 and is resolved in version 2.11.3.

• CVE-2026-54528HIGH 7.1

  JupyterLab Git, a popular Git integration extension for JupyterLab notebooks, contains a path-matching flaw that allows authenticated users to bypass access restrictions on sensitive directories. By slightly altering the capitalization of URLs on case-insensitive filesystems (like Windows or macOS), an attacker can read files that administrators intended to exclude from access. This affects versions before 0.54.0 and requires authentication but no user interaction to exploit.

• CVE-2026-55170MEDIUM 5.4

  OpenFGA, an authorization engine used by developers to manage access control, has a case-sensitivity flaw when running on MySQL databases. Prior to version 1.18.0, the system incorrectly treats distinct user identifiers like 'user:Alice' and 'user:alice' as the same, leading to authorization decisions being applied interchangeably. An authenticated user could exploit this to gain access permissions intended for a different user if naming conventions differ only in capitalization. The issue affects how the system stores and retrieves tuples (permission rules), changelogs, and authorization models from the database.

• CVE-2026-58057MEDIUM 5.0

  Flowise, a visual AI workflow platform, contains a vulnerability in how it validates environment variables for custom integrations on Windows systems. Attackers with legitimate access to configure workflow nodes can bypass security restrictions by using a lowercase variant of a blocked environment variable, allowing them to execute arbitrary code on the Flowise server. This requires authentication and administrator-level access to the workflow configuration interface.

• CVE-2026-14617LOW 3.1

  A case-sensitivity handling flaw exists in NousResearch's hermes-agent streaming reasoning component (versions up to 2026.4.30). The vulnerability allows a low-impact information disclosure when filtering streaming data, but requires both authentication and specific conditions to exploit. The vendor has elected not to patch this issue, determining the maintenance burden outweighs the security benefit given the limited attack surface and high complexity required to trigger it.

• CVE-2026-8404LOW 3.1

  Django's cache middleware has a case-sensitivity bug in how it reads `Cache-Control` directives. When a web application uses uppercase or mixed-case values in `Cache-Control` headers (e.g., `PRIVATE` instead of `private`), the middleware fails to recognize them as valid directives. This causes responses that should not be cached to be cached anyway, potentially exposing sensitive data to unauthorized users who can trigger cache hits.

• CVE-2026-44367LOW 2.7

  Klaw, a Kafka topic management and governance platform, contains a vulnerability in how it handles usernames during registration and login. The system doesn't consistently apply case sensitivity rules—treating 'Admin' and 'admin' as different or the same depending on the operation—which allows authenticated users with administrative privileges to deliberately lock out accounts or trigger denial of service conditions. This is a low-severity issue requiring administrative access to exploit, but it can impact operational availability if administrators use it maliciously or if the inconsistency is exploited in targeted attacks. The flaw was fixed in version 2.10.4.

• CVE-2026-57234LOW 2.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a flaw in its JRuby implementation that bypasses a security setting meant to prevent external network access during schema parsing. An attacker with authenticated access could craft a malicious schema file that, when parsed, fetches resources from attacker-controlled servers. This could enable Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks, potentially leaking sensitive data or compromising internal systems. The vulnerability affects JRuby users only; the standard Ruby implementation is not impacted. The issue is resolved in version 1.19.4.