SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4175-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4175-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...

CVE-2026-91819

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

EUVD-2026-78317

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819

MISP (versions ≤2.5.45) is vulnerable in its BetterSecurityComponent due to how it interacts with CakePHP's request-method override processing. When an override value outside the normal write verbs (POST, PUT, PATCH, DELETE) is supplied — for example _method=GET — CakePHP clears the parsed reques...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

ARTful

설명 ARTful은 개발자가 Android 13 + 14에서 Android 런타임ART을 수정할 수 있게 해주는 네이티브 Android 라이브러리입니다. 이 도구를 사용하면 애플리케이션 또는 Android 프레임워크 내의 모든 정적 메서드 구현을 동적으로 변경하여 애플리케이션 내부에서 호출되는 메서드에 영향을 줄 수 있습니다. 이를 통해 예기치 않은 코드를 실행하기 위해 Android ClassLoader에 대한 일반 텍스트 참조를 사용할 필요가 없어지며, 메서드 상호 참조를 완전히 제거하여 리버스 엔지니어링을 방해합니다...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory. - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that outlive expired CA certificates bsc1258543....

CVE-2026-37236

A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowin...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

Linux Distros Unpatched Vulnerability : CVE-2026-37236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP- Method-Override header in ServeMux.ServeHTTP without...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux runtime/mux.go, which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98373 CVE-2026-37236 affecting package keda 2.14.1-18

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98346 CVE-2026-37236 affecting package cf-cli 8.7.11-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98364 CVE-2026-37236 affecting package etcd 3.5.33-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98388 CVE-2026-37236 affecting package moby-engine 25.0.3-20

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98343 CVE-2026-37236 affecting package cert-manager 1.12.15-12

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...