# CWE-178.

Every Advisory and CVE whose sources give the weakness CWE-178, newest first.

## Records, newest first (an older page)

- [@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter](https://agentprime.io/advisories/GHSA-396q-4vc8-28x9.md)
  `GHSA-396q-4vc8-28x9`, `CVE-2026-49336` · npm `@microsoft/kiota-http-fetchlibrary`: affected `>=1.0.0-preview.97, <1.0.0-preview.102`, fixed in `1.0.0-preview.102` · CVSS 5.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Information disclosure, CWE-178
- [Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion](https://agentprime.io/advisories/GHSA-wmfg-5p4h-5fw3.md)
  `GHSA-wmfg-5p4h-5fw3`, `CVE-2026-123012`, `CVE-2026-52810`, `GO-2026-5712` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control, CWE-178
- [jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories](https://agentprime.io/advisories/GHSA-436q-jwfr-rm2h.md)
  `GHSA-436q-jwfr-rm2h`, `CVE-2026-54528`, `PYSEC-2026-2539` · PyPI `jupyterlab-git`: affected `<0.54.0`, fixed in `0.54.0` · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-178
- [Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247](https://agentprime.io/advisories/GHSA-8678-w3jw-xfc2.md)
  `GHSA-8678-w3jw-xfc2`, `CVE-2026-57234` · RubyGems `nokogiri`: affected `<1.19.4`, fixed in `1.19.4` · CVSS 2.6 Low · Not analysed yet · Published 19 Jun 2026 · Tags: XML external entities (XXE), CWE-178, CWE-184
- [OpenFGA Improper Policy Enforcement](https://agentprime.io/advisories/GHSA-cf98-j28v-49v6.md)
  `GHSA-cf98-j28v-49v6`, `CVE-2026-55170`, `GO-2026-5322` · Go `github.com/openfga/openfga`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 2.1 Low · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-178
- [MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence](https://agentprime.io/advisories/GHSA-j99q-93c9-h869.md)
  `GHSA-j99q-93c9-h869`, `CVE-2026-57441` · npm `@bitbonsai/mcpvault`: affected `<0.11.4`, fixed in `0.11.4` · CVSS 8.4 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-41, CWE-178
- [Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher](https://agentprime.io/advisories/GHSA-mm7m-92g8-7m47.md)
  `GHSA-mm7m-92g8-7m47`, `CVE-2026-53721` · npm `nuxt`: affected `>=3.11.0, <3.21.7 || >=4.0.0, <4.4.7`, fixed in `3.21.7`, `4.4.7` · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Broken access control, CWE-178
- [TYPO3 CMS has Broken Access Control in its Form Framework](https://agentprime.io/advisories/GHSA-hwvq-2w67-rvxp.md)
  `GHSA-hwvq-2w67-rvxp`, `CVE-2026-47346`, `PKSA-6jfs-jhtj-72x7`, `PKSA-m239-hcqk-kg59` · Packagist `typo3/cms-core` and 1 more: affected `<10.4.57 || >=11.0.0, <11.5.51 || >=12.0.0, <12.4.46 || >=13.0.0, <13.4.31 || >=14.0.0, <14.3.3`, fixed in `10.4.57`, `11.5.51`, `12.4.46`, `13.4.31`, `14.3.3` · CVSS 7.6 High · Not analysed yet · Published 12 Jun 2026 · Tags: Broken access control, CWE-178
- [HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation](https://agentprime.io/advisories/CVE-2026-46392.md)
  `CVE-2026-46392` · CVE record: haxtheweb haxcms-php · CVSS 8.7 High · Not analysed yet · Published 5 Jun 2026 · Tags: Unrestricted file upload, CWE-178
- [Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling](https://agentprime.io/advisories/GHSA-8cjm-8mp7-r2xf.md)
  `GHSA-8cjm-8mp7-r2xf`, `BIT-django-2026-8404`, `CVE-2026-8404`, `PYSEC-2026-201` · PyPI `django`: affected `<5.2.15 || >=6.0.0, <6.0.6`, fixed in `5.2.15`, `6.0.6` · CVSS 2.3 Low · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-178
- [Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects](https://agentprime.io/advisories/GHSA-9m9w-gxf7-rh8m.md)
  `GHSA-9m9w-gxf7-rh8m`, `CVE-2026-48595`, `EEF-CVE-2026-48595` · Hex `tesla`: affected `>=1.4.0, <1.18.3`, fixed in `1.18.3` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-178
- [Klaw: user lockout due to case sensitivity inconsistency](https://agentprime.io/advisories/CVE-2026-44367.md)
  `CVE-2026-44367` · CVE record: Aiven-Open klaw · CVSS 2.7 Low · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-20, CWE-178
- [Authelia Missing Username Canonicalization in Basic Auth (LDAP)](https://agentprime.io/advisories/GHSA-hjj4-hfjm-fmrj.md)
  `GHSA-hjj4-hfjm-fmrj`, `CVE-2026-47203`, `GO-2026-5430` · Go `github.com/authelia/authelia/v4`: affected `>=4.38.0, <4.39.20`, fixed in `4.39.20` · CVSS 2.9 Low · Not analysed yet · Published 29 May 2026 · Tags: Authentication bypass, CWE-178
- [tuf has platform-dependent delegation path matching](https://agentprime.io/advisories/GHSA-qp9x-wp8f-qgjj.md)
  `GHSA-qp9x-wp8f-qgjj` · PyPI `tuf`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 4.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-178
- [Envoy AI Proxy - MCP Message Smuggling Vulnerability](https://agentprime.io/advisories/GHSA-4gph-2hhr-5mwg.md)
  `GHSA-4gph-2hhr-5mwg`, `GO-2026-5121` · Go `github.com/envoyproxy/ai-gateway`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 19 May 2026 · Tags: CWE-178
- [Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering](https://agentprime.io/advisories/GHSA-8364-hfqj-pwm6.md)
  `GHSA-8364-hfqj-pwm6`, `CVE-2026-47323` · Maven `org.apache.camel:camel-cxf-rest`: affected `>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2`, fixed in `4.14.6`, `4.18.2` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 19 May 2026 · Tags: CWE-178, CWE-791
- [Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files](https://agentprime.io/advisories/GHSA-m675-2p33-xv9g.md)
  `GHSA-m675-2p33-xv9g`, `CVE-2026-45135`, `GO-2026-5492` · Go `github.com/caddyserver/caddy/v2`: affected `>=2.7.0, <2.11.3`, fixed in `2.11.3` · CVSS 8.1 High · Not analysed yet · Published 18 May 2026 · Tags: CWE-20, CWE-176, CWE-178
- [FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files](https://agentprime.io/advisories/GHSA-3g8v-8r37-cgjm.md)
  `GHSA-3g8v-8r37-cgjm`, `CVE-2026-45062`, `GO-2026-5084` · Go `github.com/dunglas/frankenphp`: affected `>=1.11.2, <1.12.3`, fixed in `1.12.3` · CVSS 8.1 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-20, CWE-176, CWE-178
- [Apache Tomcat: LockOutRealm treats user names as case-sensitive](https://agentprime.io/advisories/GHSA-5mp6-jrq3-r938.md)
  `GHSA-5mp6-jrq3-r938`, `BIT-tomcat-2026-43513`, `CVE-2026-43513` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-178
- [Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison](https://agentprime.io/advisories/CVE-2026-3833.md)
  `CVE-2026-3833` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-178
- [Apache Camel has an incomplete fix for CVE-2025-27636](https://agentprime.io/advisories/GHSA-jg2m-9x48-3gvj.md)
  `GHSA-jg2m-9x48-3gvj`, `CVE-2026-40453` · Maven `org.apache.camel:camel-coap` and 3 more: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: CWE-178
- [Heimdall: Case-sensitive host matching may lead to policy bypass](https://agentprime.io/advisories/GHSA-72h4-mxfc-jx37.md)
  `GHSA-72h4-mxfc-jx37`, `CVE-2026-42273`, `GO-2026-5200` · Go `github.com/dadrus/heimdall`: affected `<0.17.14`, fixed in `0.17.14` · CVSS 7.8 High · Not analysed yet · Published 25 Apr 2026 · Tags: CWE-178, CWE-436
- [Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation](https://agentprime.io/advisories/GHSA-43jv-5j4x-qv67.md)
  `GHSA-43jv-5j4x-qv67`, `CVE-2026-42272`, `GO-2026-5108` · Go `github.com/dadrus/heimdall`: affected `<0.17.14`, fixed in `0.17.14` · CVSS 7.8 High · Not analysed yet · Published 25 Apr 2026 · Tags: CWE-178, CWE-436
- [Multiple security fixes in justhtml](https://agentprime.io/advisories/GHSA-4p64-v8f5-r2gx.md)
  `GHSA-4p64-v8f5-r2gx`, `CVE-2026-7808` · PyPI `justhtml`: affected `<1.16.0`, fixed in `1.16.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-178, CWE-436
- [justhtml includes multiple security fixes](https://agentprime.io/advisories/GHSA-c9vm-hv86-f23r.md)
  `GHSA-c9vm-hv86-f23r`, `CVE-2026-5388` · PyPI `justhtml`: affected `<1.15.0`, fixed in `1.15.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-178, CWE-755
- [Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags](https://agentprime.io/advisories/GHSA-qmwh-9m9c-h36m.md)
  `GHSA-qmwh-9m9c-h36m`, `GO-2026-5587` · Go `github.com/gotenberg/gotenberg/v8`: affected `<8.30.0`, fixed in `8.30.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 Apr 2026 · Tags: Path traversal, CWE-178
- [OpenClaw: Windows-compatible env override keys could bypass system.run approval binding](https://agentprime.io/advisories/GHSA-98ch-45wp-ch47.md)
  `GHSA-98ch-45wp-ch47`, `CVE-2026-34426`, `CVE-2026-34510`, `GHSA-h3x4-hc5v-v2gm` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-41, CWE-178, CWE-184
- [prompts.chat Identity Confusion via Case-Sensitive Username Handling](https://agentprime.io/advisories/CVE-2026-22665.md)
  `CVE-2026-22665` · CVE record: f prompts.chat · CVSS 8.6 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-178
- [OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks](https://agentprime.io/advisories/CVE-2026-33691.md)
  `CVE-2026-33691` · CVE record: coreruleset coreruleset · CVSS 6.8 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-178
- [OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027](https://agentprime.io/advisories/CVE-2026-3532.md)
  `CVE-2026-3532` · CVE record: Drupal OpenID Connect / OAuth client · CVSS 4.2 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-178
- [DataEase is Vulnerable to H2 JDBC RCE Bypass](https://agentprime.io/advisories/CVE-2026-32939.md)
  `CVE-2026-32939` · CVE record: dataease dataease · CVSS 7.7 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-178
- [OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths](https://agentprime.io/advisories/GHSA-f8r2-vg7x-gh8m.md)
  `GHSA-f8r2-vg7x-gh8m`, `CVE-2026-32973` · npm `openclaw`: affected `<2026.3.11`, fixed in `2026.3.11` · CVSS 8.8 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-178, CWE-625
- [simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE](https://agentprime.io/advisories/GHSA-r275-fr43-pm7q.md)
  `GHSA-r275-fr43-pm7q`, `CVE-2026-28292` · npm `simple-git`: affected `>=3.15.0, <3.32.3`, fixed in `3.32.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: Command injection, CWE-76, CWE-178
- [traefik CVE-2024-45410 fix bypass: lowercase \`Connection\` tokens can delete traefik-managed forwarded identity headers (for example, \`X-Real-Ip\`) in github.com/traefik/traefik](https://agentprime.io/advisories/GHSA-92mv-8f8w-wq52.md)
  `GHSA-92mv-8f8w-wq52`, `CVE-2026-29054`, `GO-2026-4597` · Go `github.com/traefik/traefik` and 2 more: affected `*`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-178
- [MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity](https://agentprime.io/advisories/GHSA-wvj2-96wp-fq3f.md)
  `GHSA-wvj2-96wp-fq3f`, `CVE-2026-27896`, `GO-2026-4569` · Go `github.com/modelcontextprotocol/go-sdk`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 7.0 High · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-178, CWE-436
- [Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass](https://agentprime.io/advisories/GHSA-x76f-jf84-rqj8.md)
  `GHSA-x76f-jf84-rqj8`, `CVE-2026-27588`, `GO-2026-4541` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.7 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-178
- [Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass](https://agentprime.io/advisories/GHSA-g7pc-pc7g-h8jh.md)
  `GHSA-g7pc-pc7g-h8jh`, `CVE-2026-27587`, `GO-2026-4538` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.7 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-178
- [File Browser has an Authentication Bypass in User Password Update](https://agentprime.io/advisories/GHSA-hxw8-4h9j-hq2r.md)
  `GHSA-hxw8-4h9j-hq2r`, `CVE-2026-25889`, `GO-2026-4475` · Go `github.com/filebrowser/filebrowser/v2`: affected `<2.57.1`, fixed in `2.57.1` · CVSS 5.4 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-178
- [SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal](https://agentprime.io/advisories/GHSA-f72r-2h5j-7639.md)
  `GHSA-f72r-2h5j-7639`, `CVE-2026-25992`, `GO-2026-4386` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<=0.0.0-20260126094835-d5d10dd41b0c`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 28 Jan 2026 · Tags: Path traversal, CWE-178, CWE-426
- [Formio improperly authorized permission elevation through specially crafted request path](https://agentprime.io/advisories/GHSA-m654-769v-qjv7.md)
  `GHSA-m654-769v-qjv7`, `CVE-2025-67718` · npm `formio`: affected `<3.5.7 || >=4.0.0-rc.1, <4.4.3`, fixed in `3.5.7`, `4.4.3` · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Information disclosure, CWE-178
- [Cursor IDE: Sensitive File Overwrite Bypass is Possible](https://agentprime.io/advisories/CVE-2025-59944.md)
  `CVE-2025-59944` · CVE record: cursor cursor · CVSS 8.1 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-178
- [Cursor CLI Agent: Sensitive File Overwrite Bypass](https://agentprime.io/advisories/CVE-2025-61593.md)
  `CVE-2025-61593` · CVE record: cursor cursor · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection, CWE-178
- [elysia-cors Origin Validation Error](https://agentprime.io/advisories/GHSA-f9qj-4c5x-cpcw.md)
  `GHSA-f9qj-4c5x-cpcw`, `CVE-2025-50864` · npm `@elysiajs/cors`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-178, CWE-346
- [Apache Tomcat - CGI security constraint bypass](https://agentprime.io/advisories/GHSA-h2fw-rfh5-95r3.md)
  `GHSA-h2fw-rfh5-95r3`, `BIT-tomcat-2025-46701`, `CVE-2025-46701` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.0.M1, <9.0.105 || >=10.1.0-M1, <10.1.41 || >=11.0.0-M1, <11.0.7 || >=8.5.0, <=8.5.100`, fixed in `9.0.105`, `10.1.41`, `11.0.7` · CVSS 7.3 High · Not analysed yet · Published 29 May 2025 · Tags: CWE-178
- [Libsoup: cookie domain validation bypass via uppercase characters in libsoup](https://agentprime.io/advisories/CVE-2025-4035.md)
  `CVE-2025-4035` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: CWE-178
- [Flask-CORS vulnerable to Improper Handling of Case Sensitivity](https://agentprime.io/advisories/GHSA-43qf-4rqw-9q2g.md)
  `GHSA-43qf-4rqw-9q2g`, `CVE-2024-6866`, `PYSEC-2026-1383` · PyPI `flask-cors`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-178
- [Apache Camel: Camel Message Header Injection via Improper Filtering](https://agentprime.io/advisories/GHSA-2c2h-2855-mf97.md)
  `GHSA-2c2h-2855-mf97`, `CVE-2025-27636` · Maven `org.apache.camel:camel-support`: affected `>=3.10.0, <3.22.4 || >=4.0.0-M1, <4.8.5 || >=4.9.0, <4.10.2`, fixed in `3.22.4`, `4.8.5`, `4.10.2` · CVSS 5.6 Medium · EPSS 0.97 · Not analysed yet · Published 9 Mar 2025 · Tags: CWE-178
- [Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin](https://agentprime.io/advisories/GHSA-q9cm-88jx-3vfw.md)
  `GHSA-q9cm-88jx-3vfw`, `CVE-2025-24399` · Maven `org.jenkins-ci.plugins:oic-auth`: affected `<4.453.v4d7765c854f4`, fixed in `4.453.v4d7765c854f4` · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2025 · Tags: Broken access control, CWE-178
- [Gradio Blocked Path ACL Bypass Vulnerability](https://agentprime.io/advisories/GHSA-j2jg-fq62-7c3h.md)
  `GHSA-j2jg-fq62-7c3h`, `CVE-2025-23042`, `PYSEC-2025-118` · PyPI `gradio`: affected `<5.11.0`, fixed in `5.11.0` · CVSS 8.7 High · Not analysed yet · Published 14 Jan 2025 · Tags: Broken access control, CWE-178
- [Spring LDAP data exposure vulnerability](https://agentprime.io/advisories/GHSA-mqvr-2rp8-j7h4.md)
  `GHSA-mqvr-2rp8-j7h4`, `CVE-2024-38829` · Maven `org.springframework.ldap:spring-ldap-core`: affected `>=3.0.0, <3.2.8 || <2.4.4`, fixed in `3.2.8`, `2.4.4` · CVSS 3.7 Low · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-178
- [Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.](https://agentprime.io/advisories/GHSA-7cwc-fjqm-8vh8.md)
  `GHSA-7cwc-fjqm-8vh8`, `BIT-drupal-2024-55634`, `CVE-2024-55634`, `DRUPAL-CORE-2024-004`, `PKSA-bnz1-mtnt-3dxx`, `PKSA-ts55-c66h-g96n`, `PKSA-vt8m-56zm-d92y` · Packagist `drupal/core`: affected `>=8.0.0, <10.2.11 || >=10.3.0, <10.3.9 || >=11.0.0, <11.0.8`, fixed in `10.2.11`, `10.3.9`, `11.0.8` · CVSS 8.1 High · Not analysed yet · Published 20 Nov 2024 · Tags: CWE-178, CWE-289
- [Spring Framework DataBinder Case Sensitive Match Exception](https://agentprime.io/advisories/GHSA-4gc7-5j7h-4qph.md)
  `GHSA-4gc7-5j7h-4qph`, `CVE-2024-38820` · Maven `org.springframework:spring-context` and 1 more: affected `>=6.1.0, <6.1.14 || >=6.0.0, <=6.0.24 || <=5.3.40`, fixed in `6.1.14` · CVSS 3.1 Low · Not analysed yet · Published 18 Oct 2024 · Tags: CWE-178
- [Mozilla Firefox: In violation of spec, cookie prefixes such as \`\_\_Secure\` were being ignored if they were…](https://agentprime.io/advisories/CVE-2024-5699.md)
  `CVE-2024-5699` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-178
- [social-auth-app-django affected by Improper Handling of Case Sensitivity](https://agentprime.io/advisories/GHSA-2gr8-3wc7-xhj3.md)
  `GHSA-2gr8-3wc7-xhj3`, `CVE-2024-32879`, `PYSEC-2026-1931` · PyPI `social-auth-app-django`: affected `<5.4.1`, fixed in `5.4.1` · CVSS 4.9 Medium · Not analysed yet · Published 24 Apr 2024 · Tags: Authentication bypass, CWE-178
- [Vite dev server option \`server.fs.deny\` can be bypassed when hosted on case-insensitive filesystem](https://agentprime.io/advisories/GHSA-c24v-8rfc-w8vw.md)
  `GHSA-c24v-8rfc-w8vw`, `CVE-2024-23331` · npm `vite`: affected `>=2.7.0, <2.9.17 || >=3.0.0, <3.2.8 || >=4.0.0, <4.5.2 || >=5.0.0, <5.0.12`, fixed in `2.9.17`, `3.2.8`, `4.5.2`, `5.0.12` · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2024 · Tags: Information disclosure, Broken access control, CWE-178
- [curl: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…](https://agentprime.io/advisories/CVE-2023-46218.md)
  `CVE-2023-46218` · CVE record: curl curl · CVSS 6.5 Medium · Not analysed yet · Published 7 Dec 2023 · Tags: CWE-178
- [Chamilo LMS Htaccess File Upload Security Bypass](https://agentprime.io/advisories/CVE-2023-3545.md)
  `CVE-2023-3545` · CVE record: Chamilo Chamilo · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-178
- [Arbitrary File Overwrite in Eclipse JGit](https://agentprime.io/advisories/GHSA-3p86-9955-h393.md)
  `GHSA-3p86-9955-h393`, `CVE-2023-4759` · Maven `org.eclipse.jgit:org.eclipse.jgit`: affected `>=6.0.0.202111291000-r, <6.6.1.202309021850-r || <5.13.3.202401111512-r`, fixed in `6.6.1.202309021850-r`, `5.13.3.202401111512-r` · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2023 · Tags: Path traversal, CWE-178
- [An issue was discovered in ONOS 2.5.1.](https://agentprime.io/advisories/CVE-2022-29604.md)
  `CVE-2022-29604` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2023 · Tags: CWE-178
- [Improper handling of case sensitivity in Spring Framework](https://agentprime.io/advisories/GHSA-g5mm-vmx4-3rg7.md)
  `GHSA-g5mm-vmx4-3rg7`, `CVE-2022-22968` · Maven `org.springframework:spring-context`: affected `>=5.3.0, <5.3.19 || <5.2.21.RELEASE`, fixed in `5.3.19`, `5.2.21.RELEASE` · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2022 · Tags: CWE-178

Newest: <https://agentprime.io/advisories/tag/cwe-178.md>
Older: <https://agentprime.io/advisories/tag/cwe-178.md?cursor=WyIyMDIyLTA0LTE1VDAwOjAwOjMyLjAwMDAwMFoiLCJHSFNBLWc1bW0tdm14NC0zcmc3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-178&cursor=WyIyMDI2LTA2LTI2VDIyOjMyOjIxLjAwMDAwMFoiLCJHSFNBLWo3NDgtaDM2My13cWo4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-178/?cursor=WyIyMDI2LTA2LTI2VDIyOjMyOjIxLjAwMDAwMFoiLCJHSFNBLWo3NDgtaDM2My13cWo4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.