Permalink CVE-2026-11702

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 4 hours ago

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes

• https://github.com/daoswald/Bytes-Random-Secure-Tiny/issues/6 issue-tracking
• https://github.com/daoswald/Bytes-Random-Secure-Tiny/pull/7 issue-tracking
• https://security.metacpan.org/patches/B/Bytes-Random-Secure-Tiny/1.011/CVE-2026… patch
• https://www.cve.org/CVERecord?id=CVE-2026-41564 related

---

Bytes-Random-Secure-Tiny

• =<1.011

Permalink CVE-2026-11625

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  4 packages

  • perlPackages.BytesRandomSecureTiny
  • perl540Packages.BytesRandomSecureTiny
  • perl538Packages.BytesRandomSecureTiny
  • perl5Packages.BytesRandomSecureTiny
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 4 hours ago

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes

• https://github.com/daoswald/Bytes-Random-Secure/issues/3 issue-tracking
• https://github.com/daoswald/Bytes-Random-Secure/pull/4 issue-tracking
• https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625… patch
• https://www.cve.org/CVERecord?id=CVE-2026-41564 related

---

Bytes-Random-Secure

• =<0.29

Permalink CVE-2026-54341

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  4 packages

  • dragonfly-reverb
  • python312Packages.dragonfly
  • python313Packages.dragonfly
  • python314Packages.dragonfly
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 4 hours ago

Dragonfly: RESTORE operations may crash the server

• https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cwjr-j869-h8q9 x_refsource_CONFIRMexploit
• https://github.com/dragonflydb/dragonfly/pull/7502 x_refsource_MISC

---

dragonfly

• ==< 1.39.0

Permalink CVE-2026-57918

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

libnfs through 6.0.2 before 935b8db has an xid integer underflow …

• https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a3168…

---

libnfs

• <935b8db712b3c6649bc57ddc276526c4a31680de

Permalink CVE-2026-48529

6.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

• https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349 x_refsource_CONFIRM

---

github-mcp-server

• ==>= 0.22.0, < 1.1.2

Needs a backport

Permalink CVE-2026-57231

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 4 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  9 packages

  • podman-tui
  • podman-bootc
  • cockpit-podman
  • podman-compose
  • podman-desktop
  • nomad-driver-podman
  • python312Packages.podman
  • python313Packages.podman
  • python314Packages.podman
  4 hours ago
• @LeSuisse accepted 4 hours ago
• @LeSuisse published on GitHub 4 hours ago

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

• https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68 x_refsource_CONFIRM
• https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050 x_refsource_MISC

---

podman

• ==>= 1.8.1, < 5.8.4

Permalink CVE-2026-48129

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 1 week ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra task inputFiles accepts traversal filenames for worker file writes

• https://github.com/kestra-io/kestra/security/advisories/GHSA-q3fw-mvgv-pjr2 x_refsource_CONFIRM

---

kestra

• ==< 1.0.43
• ==>= 1.3.0, < 1.3.19
• ==>= 1.2.0, < 1.2.19
• ==>= 1.1.0, < 1.1.19

Permalink CVE-2026-49984

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

• https://github.com/kestra-io/kestra/security/advisories/GHSA-qw4v-6w32-xx9h x_refsource_CONFIRM

---

kestra

• ==< 1.0.45
• ==>= 1.1.0, < 1.3.23

Permalink CVE-2026-49869

10.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

• https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx x_refsource_CONFIRM

---

kestra

• ==< 1.0.45
• ==>= 1.1.0, < 1.3.21

Permalink CVE-2026-45807

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

• https://github.com/kestra-io/kestra/security/advisories/GHSA-3529-p4wf-xp79 x_refsource_CONFIRM

---

kestra

• ==< 1.0.43
• ==>= 1.1.0, < 1.3.19

Permalink CVE-2026-55069

8.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

• https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h x_refsource_CONFIRM

---

kestra

• ==< 1.3.24

Permalink CVE-2026-53576

10.0 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

• https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f x_refsource_CONFIRM

---

kestra

• ==< 1.0.45
• ==>= 1.1.0, < 1.3.21

Permalink CVE-2026-53577

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)

• https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42 x_refsource_CONFIRM

---

kestra

• ==< 1.0.45
• ==>= 1.1.0, < 1.3.21

Permalink CVE-2026-55448

6.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • ocamlPackages.promise_jsoo
  • python312Packages.heatmiserv3
  • python313Packages.heatmiserv3
  • python314Packages.heatmiserv3
  • haskellPackages.unsafe-promises
  • ocamlPackages_latest.promise_jsoo
  • python313Packages.promise
  • haskellPackages.promises
  • python312Packages.promise
  • python314Packages.promise
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

mise: Local credential_command executes untrusted config

• https://github.com/jdx/mise/security/advisories/GHSA-29hf-rm4x-xxph x_refsource_CONFIRM

---

mise

• ==< 2026.6.4

Permalink CVE-2026-54557

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • haskellPackages.promises
  • python312Packages.promise
  • python313Packages.promise
  • python314Packages.promise
  • ocamlPackages.promise_jsoo
  • python312Packages.heatmiserv3
  • python313Packages.heatmiserv3
  • python314Packages.heatmiserv3
  • haskellPackages.unsafe-promises
  • ocamlPackages_latest.promise_jsoo
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

mise HTTP backend uses raw version path for install symlink destination

• https://github.com/jdx/mise/security/advisories/GHSA-f94h-j2qg-fxw3 x_refsource_CONFIRMexploit

---

mise

• ==< 2026.6.1

Permalink CVE-2026-55441

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • haskellPackages.promises
  • python314Packages.promise
  • ocamlPackages.promise_jsoo
  • python312Packages.heatmiserv3
  • python313Packages.heatmiserv3
  • python314Packages.heatmiserv3
  • haskellPackages.unsafe-promises
  • ocamlPackages_latest.promise_jsoo
  • python313Packages.promise
  • python312Packages.promise
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

mise: Arbitrary command execution via task-include files in an untrusted, config-less repository

• https://github.com/jdx/mise/security/advisories/GHSA-77g9-363w-rccq x_refsource_CONFIRM

---

mise

• ==< 2026.6.4

Permalink CVE-2026-49370

3.4 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 4 weeks ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.1.13162

Permalink CVE-2026-57926

2.6 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-57925

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-57924

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-57922

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-57923

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-57921

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.16593

Permalink CVE-2026-47207

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv x_refsource_CONFIRMexploit

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.34.0, < 1.35.13
• ==>= 1.36.0, < 1.36.9
• ==>= 1.38.0, < 1.38.3

Permalink CVE-2026-47205

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • home-assistant-component-tests.enphase_envoy
  • python314Packages.envoy-data-plane
  • python314Packages.envoy-reader
  • python313Packages.envoy-reader
  • python312Packages.envoy-reader
  • python314Packages.envoy-utils
  • python313Packages.envoy-utils
  • python312Packages.envoy-utils
  • python313Packages.envoy-data-plane
  • opa-envoy-plugin
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-mvh9-767w-x47j x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.36.0, < 1.36.9
• ==>= 1.38.0, < 1.38.3

Permalink CVE-2026-47778

4.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  • python314Packages.envoy-data-plane
  • python314Packages.envoy-utils
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7 x_refsource_CONFIRM

---

envoy

• ==< 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-48497

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • home-assistant-component-tests.enphase_envoy
  • python314Packages.envoy-data-plane
  • python313Packages.envoy-data-plane
  • python313Packages.envoy-utils
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: Abnormal process termination in DNS UDP filter

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q x_refsource_CONFIRM

---

envoy

• ==< 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-48042

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-reader
  • python313Packages.envoy-reader
  • python313Packages.envoy-utils
  • python312Packages.envoy-utils
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: Stack overflow in destructor of highly nested JSON

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv x_refsource_CONFIRM
• https://github.com/envoyproxy/envoy/blob/099a9d71ebfd8aa9f823e1738b34138cb634a07b/source/common/json/json_loader.h#L21 x_refsource_MISC

---

envoy

• ==< 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-48706

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • home-assistant-component-tests.enphase_envoy
  • python314Packages.envoy-data-plane
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-reader
  • python313Packages.envoy-reader
  • python312Packages.envoy-reader
  • python314Packages.envoy-utils
  • python313Packages.envoy-utils
  • python312Packages.envoy-utils
  • opa-envoy-plugin
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy Heap Buffer Overflow in TcpStatsdSink

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4 x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.34.0, < 1.35.13
• ==>= 1.38.0, < 1.38.3
• ==>= 1.36.0, < 1.36.9

Permalink CVE-2026-48743

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf x_refsource_CONFIRM

---

envoy

• ==>= 1.35.0, < 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-47692

4.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.34.0, < 1.35.13
• ==>= 1.36.0, < 1.36.9
• ==>= 1.38.0, < 1.38.3

Permalink CVE-2026-47204

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • home-assistant-component-tests.enphase_envoy
  • python314Packages.envoy-data-plane
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-reader
  • python313Packages.envoy-reader
  • python312Packages.envoy-reader
  • python314Packages.envoy-utils
  • python313Packages.envoy-utils
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6 x_refsource_CONFIRM

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.26.0, < 1.35.13
• ==>= 1.36.0, < 1.36.9
• ==>= 1.38.0, < 1.38.3

Permalink CVE-2026-47775

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-396h-jpq4-vc7p x_refsource_CONFIRM

---

envoy

• ==< 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-48044

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg x_refsource_CONFIRM

---

envoy

• ==>= 1.23.0, < 1.35.11
• ==>= 1.36.0, < 1.36.7
• ==>= 1.38.0, < 1.38.1
• ==>= 1.37.0, < 1.37.3

Permalink CVE-2026-47221

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 5 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  10 packages

  • opa-envoy-plugin
  • python312Packages.envoy-utils
  • python313Packages.envoy-utils
  • python314Packages.envoy-utils
  • python312Packages.envoy-reader
  • python313Packages.envoy-reader
  • python314Packages.envoy-reader
  • python313Packages.envoy-data-plane
  • python314Packages.envoy-data-plane
  • home-assistant-component-tests.enphase_envoy
  5 hours ago
• @LeSuisse accepted 5 hours ago
• @LeSuisse published on GitHub 5 hours ago

Envoy: Null pointer deref in internal redirects

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr x_refsource_CONFIRMexploit

---

envoy

• ==>= 1.37.0, < 1.37.5
• ==>= 1.18.0, < 1.35.13
• ==>= 1.36.0, < 1.36.9
• ==>= 1.38.0, < 1.38.3