CVE-2026-86502

JetBrains IntelliJ IDEA versions before 2026.2.2 contain a vulnerability in the IJent gRPC server , where missing TLS encryption and authentication allowed an attacker with local access to achieve arbitrary code execution on Remote Development hosts. The CVSS 3.1 score is 8.4 (High) , reflecting ...

CVE-2026-86502

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

EUVD-2026-72518

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts...

CVE-2026-45799

A flaw was found in Wire, a library used for gRPC and protocol buffers. In the wire-runtime component, a remote attacker can exploit improper validation of a length-delimited field. By sending a crafted protobuf message with a negative length, the system attempts to access an invalid memory...

resterm v1.5.6

Resterm A terminal API client for REST, GraphQL, gRPC, WebSocket and SSE. Resterm stores API requests in plain .http and .rest files that you can diff, review and track in version control. Edit and send requests in the terminal, or run them from scripts and CI. Request files support workflows,...

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

...

SUSE CVE-2026-73080

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

The vulnerability in the `internal/transport/transport.go` file of the gRPC-Go framework for remote procedure calls in the Go programming language allows a attacker to cause a service failure.

The vulnerability in the internal/transport/transport.go file of the Go-based gRPC-Go framework for remote procedure calls involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

OPENSUSE-SU-2026:21793-1 Security update for hauler

This update for hauler fixes the following issues: Changes in hauler: - update to 2.1.0 bsc1265425, CVE-2026-41888: v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with...

Improper Authentication

github.com/seaweedfs/seaweedfs is vulnerable to improper authentication. The vulnerability is due to the filer registering the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, which allows an attacker who can reach the filer gRPC po...

CVE-2026-37236

A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowin...

SUSE CVE-2026-84303

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as...

SUSE CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

EUVD-2026-56156

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control...

GHSA-2V6V-25FM-P4FG SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

Linux Distros Unpatched Vulnerability : CVE-2026-84304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvM...

Linux Distros Unpatched Vulnerability : CVE-2026-84303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header...

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny e.g., 1-byte HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment...

GHSA-VP52-PCJ8-J9QC gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny e.g., 1-byte HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment...