AZL-98367 CVE-2026-37236 affecting package flannel for versions less than 0.24.2-32

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98436 CVE-2026-37236 affecting package telegraf for versions less than 1.31.0-33

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98256 CVE-2026-37236 affecting package cri-o 1.30.1-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98355 CVE-2026-37236 affecting package cri-tools for versions less than 1.32.0-8

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98361 CVE-2026-37236 affecting package docker-compose for versions less than 2.27.0-14

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-98253 CVE-2026-37236 affecting package azl-otel-collector 0.127.0-1

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where the source-address critical option in permissions returned by certain authentication callbacks was not validated. Specifically, the check was only enforced for PublicKeyCallback and VerifiedPublicKeyCallback , meaning restrictio...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

Incorrect Authorization

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and...

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Backdoor vulnerability discovered by ashv4ni in WordPress Theme Newspapers X versions 1.0.46-1.0.48...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

UBUNTU-CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620

CVE-2026-80620 is a Linux kernel vulnerability in the PCI/MSI subsystem . A prior commit (1a8d4c6ecb4c) added an iounmap(dev->msix_base) on the error path of msix_capability_init(), but pci_free_msi_irqs() — called earlier via the __free(free_msi_irqs) cleanup — already unmapped the region and...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620 Revert "PCI/MSI: Unmap MSI-X region on error"

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

EUVD-2026-67496

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...