authorization bypass

Microsoft’s CVE-2026-33186 entry for gRPC-Go points to an authorization bypass rooted in a deceptively small parsing flaw: a missing leading slash in the HTTP/2 :path pseudo-header. In practice, that means a request can slip past policy logic that assumes canonical gRPC paths always begin with...

A high-severity asuthorization bypass affecting Hubitat Elevation hubs — tracked as CVE-2026-1201 — was published in a CISA coordination notice on January 22, 2026; the issue allows a remote, authenticated user to escalate control beyond their authorized scope by manipulating client-side request...

Siemens has disclosed a critical authorization‑bypass flaw in its Industrial Edge product family (tracked as CVE‑2025‑40805) that allows unauthenticated remote actors to circumvent authentication on specific API endpoints and impersonate legitimate users; Siemens has issued updated releases for...

Siemens has disclosed a critical authorization bypass in its Industrial Edge Device Kit that allows unauthenticated remote actors to impersonate legitimate users by abusing improperly protected API endpoints — a flaw Siemens and U.S. authorities rate at the highest severity and that demands...