CVE-2026-101902: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

Security update for distribution (important)

openSUSE security update: security update for distribution ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21898-1 Rating: important References: bsc1268884 bsc1276677 bsc1277966 bsc1278997 bsc1279219 bsc1279316 Cross-References: CVE-2026-37236...

EUVD-2026-84967

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-17635

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-17635 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-17635 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-17635

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to perform unauthorized actions . This issue stems from an improper configuration of HTTP method-based security constraints . The vulnerability is assigned a CRITICAL sev...

PT-2026-97074

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper configuration of HTTP method-based security constraints could allow a remote attacker to perform unauthorized actions...

CVE-2026-17635: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

CVE-2026-52740

GoCD (continuous delivery server) versions 18.7.0 through 26.1.0 are affected by an authorization bypass in the Get Template Config API . The root cause is a case-sensitive comparison of HTTP method names when selecting authorization filters. A lower-privileged authenticated user can send a reque...

CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...

CVE-2026-94379

CVE-2026-94379 affects MISP (versions

EUVD-2026-83905

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

CVE-2026-94379 MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

PT-2026-96130

Name of the Vulnerable Software and Affected Versions GoCD versions 18.7.0 through 26.0.x Description The Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. This allows an authenticated user with low privileges to bypass view permission...