https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T10:24:21.012757+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-37236 fkie_cve-2026-37236 2026-10-07T10:24:21.034235+00:00

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

 https://vulnerability.circl.lu/vuln/ghsa-6gx8-r37x-4vw8 GHSA-6gx8-r37x-4vw8 2026-10-07T10:24:21.034417+00:00

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

 https://vulnerability.circl.lu/vuln/msrc_cve-2026-37236 msrc_CVE-2026-37236 β€” grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override he… 2026-10-07T10:24:21.034498+00:00 msrc_CVE-2026-37236 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11667-1 openSUSE-SU-2026:11667-1 β€” hauler-2.1.0-1.1 on GA media 2026-10-07T10:24:21.034595+00:00

hauler-2.1.0-1.1 on GA media

 https://vulnerability.circl.lu/vuln/suse-su-2026:23456-1 SUSE-SU-2026:23456-1 β€” Security update for helm 2026-10-07T10:24:21.034660+00:00

Security update for helm

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-37236 UBUNTU-CVE-2026-37236 2026-10-07T10:24:21.034718+00:00

Affected: Ubuntu:18.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:20.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:22.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:24.04:LTS: golang-github-grpc-ecosystem-grpc-gateway, Ubuntu:26.04:LTS: golang-github-grpc-ecosystem-grpc-gateway

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.