Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.3 CVE-2026-55448

mise: Local credential_command executes untrusted config_CVE-2026-55448

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credential_command from local proj...

jdx mise < 2026.6.4 CVE
MEDIUM 5.5 CVE-2026-54557

mise HTTP backend uses raw version path for install symlink destination_CVE-2026-54557

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination fro...

jdx mise < 2026.6.1 CVE
MEDIUM 5.9 CVE-2026-48706

Envoy Heap Buffer Overflow in TcpStatsdSink_CVE-2026-48706

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vul...

envoyproxy envoy >= 1.38.0, < 1.38.3 CVE
MEDIUM 5.9 CVE-2026-48497

Envoy: Abnormal process termination in DNS UDP filter_CVE-2026-48497

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where...

envoyproxy envoy >= 1.38.0, < 1.38.1 CVE
MEDIUM 4.4 CVE-2026-47778

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)_CVE-2026-47778

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a structural f...

envoyproxy envoy >= 1.38.0, < 1.38.1 CVE
MEDIUM 6.8 CVE-2026-47775

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption_CVE-2026-47775

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTT...

envoyproxy envoy >= 1.38.0, < 1.38.1 CVE
MEDIUM 4.8 CVE-2026-47692

Envoy: PROXY Protocol v2 header generator emits “skipped” TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream_CVE-2026-47692

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY...

envoyproxy envoy >= 1.38.0, < 1.38.3 CVE
MEDIUM 5.9 CVE-2026-47221

Envoy: Null pointer deref in internal redirects_CVE-2026-47221

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the r...

envoyproxy envoy >= 1.38.0, < 1.38.3 CVE
MEDIUM 6.5 CVE-2026-47207

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message_CVE-2026-47207

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy...

envoyproxy envoy >= 1.38.0, < 1.38.3 CVE
MEDIUM 6.5 CVE-2026-47204

Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes_CVE-2026-47204

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.26.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the e...

envoyproxy envoy >= 1.38.0, < 1.38.3 CVE