DEBIAN-CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

EUVD-2026-70981

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

PT-2026-85455

MISP contains a cross-site request forgery CSRF vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addServer, and removeServer actions share the initialiseSGQuickEdit helper, where the HTTP method validation intended to restrict these operations to POST requests w...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

Linux Distros Unpatched Vulnerability : CVE-2026-37236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP- Method-Override header in ServeMux.ServeHTTP without...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

AZL-98373 CVE-2026-37236 affecting package keda for versions less than 2.14.1-19

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98388 CVE-2026-37236 affecting package moby-engine 25.0.3-20

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98346 CVE-2026-37236 affecting package cf-cli for versions less than 8.7.11-9

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98349 CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98355 CVE-2026-37236 affecting package cri-tools for versions less than 1.32.0-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98361 CVE-2026-37236 affecting package docker-compose for versions less than 2.27.0-14

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98436 CVE-2026-37236 affecting package telegraf for versions less than 1.31.0-33

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98253 CVE-2026-37236 affecting package azl-otel-collector 0.127.0-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98379 CVE-2026-37236 affecting package kubernetes for versions less than 1.30.10-30

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

DEBIAN-CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...