[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-37236":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":21,"duplicate_of":9,"upstream":25,"downstream":26,"duplicates":53,"related":54,"reserved_at":9,"published_at":68,"modified_at":69,"state":70,"summary":71,"references_raw":80,"kevs":116,"epss":117,"epss_history":120,"metrics":186,"affected":197},"CVE-2026-37236","grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-639","Authorization Bypass Through User-Controlled Key","The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.","weakness","Incomplete","Base","High",[],[],[22,23,24],"DEBIAN-CVE-2026-37236","UBUNTU-CVE-2026-37236","openSUSE-SU-2026:11669-1",[],[27,29,31,33,35,37,39,41,43,45,47,49,51],{"_key":28},"OPENSUSE-SU-2026:11676-1",{"_key":30},"OPENSUSE-SU-2026:11667-1",{"_key":32},"OPENSUSE-SU-2026:11697-1",{"_key":34},"OPENSUSE-SU-2026:11718-1",{"_key":36},"OPENSUSE-SU-2026:21793-1",{"_key":38},"OPENSUSE-SU-2026:21801-1",{"_key":40},"OPENSUSE-SU-2026:21809-1",{"_key":42},"SUSE-SU-2026:4045-1",{"_key":44},"SUSE-SU-2026:23456-1",{"_key":46},"SUSE-SU-2026:23506-1",{"_key":48},"SUSE-SU-2026:4175-1",{"_key":50},"SUSE-SU-2026:23522-1",{"_key":52},"OPENSUSE-SU-2026:11803-1",[],[55,56,57,58,59,60,61,62,63,64,65,66,67],{"_key":28},{"_key":30},{"_key":32},{"_key":34},{"_key":36},{"_key":38},{"_key":40},{"_key":42},{"_key":44},{"_key":46},{"_key":48},{"_key":50},{"_key":52},"2026-08-28T00:00:00.000Z","2026-09-02T18:14:42.882Z","Deferred",{"cisa_kev":72,"cisa_ransomware":72,"cisa_vendor":9,"epss_severity":73,"epss_score":74,"severity":75,"severity_score":76,"severity_version":77,"severity_source":78,"severity_vector":79,"severity_status":70},false,"low",0.0044,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[81,88,92,96,102,106,110],{"url":82,"sources":83,"tags":86},"https://github.com/grpc-ecosystem/grpc-gateway/commit/72123cd4f32545f6e1376873f412dcdcbcf29acc",[78,84,85],"nvd","osv_ubuntu",[87],"REPORT",{"url":89,"sources":90,"tags":91},"https://github.com/grpc-ecosystem/grpc-gateway",[78,84,85],[87],{"url":93,"sources":94,"tags":95},"https://s00me00ne.com/cve/cve-2026-37236/",[78,84,85],[87],{"url":97,"sources":98,"tags":100},"https://security-tracker.debian.org/tracker/CVE-2026-37236",[99],"osv_debian",[101],"Advisory",{"url":103,"sources":104,"tags":105},"https://ubuntu.com/security/CVE-2026-37236",[85],[87],{"url":107,"sources":108,"tags":109},"https://www.cve.org/CVERecord?id=CVE-2026-37236",[85],[87],{"url":111,"sources":112,"tags":114},"https://www.suse.com/security/cve/CVE-2026-37236",[113],"osv_opensuse",[115],"WEB",[],{"date":118,"score":74,"percentile":119},"2026-09-19",0.37647,[121,125,128,131,134,137,140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185],{"date":122,"score":123,"percentile":124},"2026-08-29",0.00176,0.07201,{"date":126,"score":123,"percentile":127},"2026-08-30",0.07216,{"date":129,"score":123,"percentile":130},"2026-08-31",0.07214,{"date":132,"score":123,"percentile":133},"2026-09-01",0.07223,{"date":135,"score":123,"percentile":136},"2026-09-02",0.07207,{"date":138,"score":74,"percentile":139},"2026-09-03",0.36787,{"date":141,"score":74,"percentile":142},"2026-09-04",0.36821,{"date":144,"score":74,"percentile":145},"2026-09-05",0.36777,{"date":147,"score":74,"percentile":148},"2026-09-06",0.36889,{"date":150,"score":74,"percentile":151},"2026-09-07",0.36895,{"date":153,"score":74,"percentile":154},"2026-09-08",0.36914,{"date":156,"score":74,"percentile":157},"2026-09-09",0.37068,{"date":159,"score":74,"percentile":160},"2026-09-10",0.37077,{"date":162,"score":74,"percentile":163},"2026-09-11",0.37102,{"date":165,"score":74,"percentile":166},"2026-09-12",0.37192,{"date":168,"score":74,"percentile":169},"2026-09-13",0.37144,{"date":171,"score":74,"percentile":172},"2026-09-14",0.37166,{"date":174,"score":74,"percentile":175},"2026-09-15",0.37244,{"date":177,"score":74,"percentile":178},"2026-09-16",0.37408,{"date":180,"score":74,"percentile":181},"2026-09-17",0.37483,{"date":183,"score":74,"percentile":184},"2026-09-18",0.37633,{"date":118,"score":74,"percentile":119},[187,191,193,195],{"source":78,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":188,"cvss_v4_0":9},{"baseScore":76,"baseSeverity":189,"vectorString":79,"impactScore":76,"exploitabilityScore":190},"CRITICAL",10,{"source":84,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":192,"cvss_v4_0":9},{"baseScore":76,"baseSeverity":189,"vectorString":79,"impactScore":76,"exploitabilityScore":190},{"source":99,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":194,"cvss_v4_0":9},{"baseScore":76,"baseSeverity":9,"vectorString":79,"impactScore":76,"exploitabilityScore":190},{"source":85,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":196,"cvss_v4_0":9},{"baseScore":76,"baseSeverity":9,"vectorString":79,"impactScore":76,"exploitabilityScore":190},[198,215,224],{"ecosystem":199,"name":200,"vendor":201,"product":200,"cpe_part":9,"purl_type":202,"purl_namespace":201,"purl_name":200,"source":9,"versions":203},"Debian","golang-github-grpc-ecosystem-grpc-gateway","debian","deb",[204,208,209,210,211],{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":212,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":213,"version_end_type":214,"fixed_in":9},"lt2_30_0_1","2.30.0-1","excluding",{"ecosystem":216,"name":200,"vendor":217,"product":200,"cpe_part":9,"purl_type":202,"purl_namespace":217,"purl_name":200,"source":9,"versions":218},"Ubuntu","ubuntu",[219,220,221,222,223],{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":205,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":225,"name":226,"vendor":227,"product":228,"cpe_part":9,"purl_type":229,"purl_namespace":227,"purl_name":228,"source":9,"versions":230},"openSUSE","helm3","opensuse","helm3&distro=openSUSE Tumbleweed","rpm",[231],{"version":232,"is_range":206,"range_type":207,"version_start":9,"version_start_type":9,"version_end":233,"version_end_type":214,"fixed_in":9},"lt3_21_3_7_1","3.21.3-7.1"]