Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001433 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method Only buffer objects are valid return values of ST...

GHSA-2GH4-JMWQ-RR8W piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

SUSE CVE-2026-54228

A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...

Vikunja has a project duplication bypasses write-permission check on the target parent project

Summary The project-duplication endpoint fails to enforce write access to the target parent project. Any authenticated non-link-share user can duplicate a project they can read into any parent project on the instance, regardless of whether they have write access to that parent — injecting an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

AZL-98364 CVE-2026-37236 affecting package etcd 3.5.33-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98388 CVE-2026-37236 affecting package moby-engine 25.0.3-20

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98346 CVE-2026-37236 affecting package cf-cli 8.7.11-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98373 CVE-2026-37236 affecting package keda for versions less than 2.14.1-19

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98343 CVE-2026-37236 affecting package cert-manager for versions less than 1.12.15-14

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98349 CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter 0.12.0-9

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98361 CVE-2026-37236 affecting package docker-compose 2.27.0-13

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98436 CVE-2026-37236 affecting package telegraf for versions less than 1.31.0-33

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98376 CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98355 CVE-2026-37236 affecting package cri-tools 1.32.0-7

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

DEBIAN-CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...