https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:04:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-363260 EUVD-2026-363260 https://cve.radiocsirt.org/vuln/euvd-2026-363260 https://cve.radiocsirt.org/vuln/fkie_cve-2026-37236 <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-37236 https://cve.radiocsirt.org/vuln/ghsa-6gx8-r37x-4vw8 <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> https://cve.radiocsirt.org/vuln/ghsa-6gx8-r37x-4vw8 https://cve.radiocsirt.org/vuln/msrc_cve-2026-37236 msrc_CVE-2026-37236 https://cve.radiocsirt.org/vuln/msrc_cve-2026-37236 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11667-1 <p>hauler-2.1.0-1.1 on GA media</p> <p>hauler-2.1.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11667-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23456-1 <p>Security update for helm</p> <p>Security update for helm</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23456-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-37236 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:20.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:22.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:24.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:26.04:LTS: golang-github-grpc-ecosystem-grpc-gateway</p> <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:20.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:22.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:24.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:26.04:LTS: golang-github-grpc-ecosystem-grpc-gateway</p> <p>grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-37236