169555 matches found
AZL-98379 CVE-2026-37236 affecting package kubernetes 1.30.10-29
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
AZL-98358 CVE-2026-37236 affecting package docker-buildx 0.14.0-16
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
AZL-98253 CVE-2026-37236 affecting package azl-otel-collector 0.127.0-1
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
CVE-2026-37236
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
UBUNTU-CVE-2026-37236
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
CVE-2026-56854
A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...
CVE-2026-56854
CVE-2026-56854 affects golang.org/x/crypto/ssh . The source-address critical option in Permissions returned by authentication callbacks was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths (extending a prior fix for CVE-2026-46595). Callbacks for PasswordCallback , Keyb...
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...
GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...
CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...
CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-81767
CVE-2026-81767 affects the WordPress Simple Payment plugin in versions 2.5.2 and earlier , presenting an unauthenticated Broken Access Control flaw. The CVSS 3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating an attacker requires no credentials or user...
CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...
CVE-2026-81761
WpEvently is a WordPress plugin affected by a Broken Access Control vulnerability in versions ≤ 5.5.0 . The flaw allows a Subscriber -level user to perform actions beyond their intended permissions, resulting in a low confidentiality impact with no integrity or availability loss. The CVSS 3.1 sco...
EUVD-2026-67733
Subscriber Broken Access Control in WpEvently = 5.5.0 versions...
EUVD-2026-67734
Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...
EUVD-2026-67731
Contributor Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-81759 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WpEvently = 5.5.0 versions...