https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:52:07.220405+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-363260 EUVD-2026-363260 2026-10-03T01:52:07.464582+00:00 EUVD-2026-363260 https://cve.radiocsirt.org/vuln/fkie_cve-2026-37236 fkie_cve-2026-37236 2026-10-03T01:52:07.464627+00:00

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

 https://cve.radiocsirt.org/vuln/ghsa-6gx8-r37x-4vw8 GHSA-6gx8-r37x-4vw8 2026-10-03T01:52:07.464664+00:00

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-37236 msrc_CVE-2026-37236 β€” grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override he… 2026-10-03T01:52:07.464681+00:00 msrc_CVE-2026-37236 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11667-1 openSUSE-SU-2026:11667-1 β€” hauler-2.1.0-1.1 on GA media 2026-10-03T01:52:07.464702+00:00

hauler-2.1.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:23456-1 SUSE-SU-2026:23456-1 β€” Security update for helm 2026-10-03T01:52:07.464718+00:00

Security update for helm

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-37236 UBUNTU-CVE-2026-37236 2026-10-03T01:52:07.464735+00:00

Affected: Ubuntu:18.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:20.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:22.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:24.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:26.04:LTS: golang-github-grpc-ecosystem-grpc-gateway

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.