https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T09:54:12.578938+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-02007 bdu:2023-02007 2026-10-07T09:54:12.687140+00:00 bdu:2023-02007 https://cve.radiocsirt.org/vuln/bit-envoy-2023-27487 BIT-envoy-2023-27487 — Envoy client may fake the header `x-envoy-original-path` 2026-10-07T09:54:12.687256+00:00

Affected: Bitnami: envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-214668 EUVD-2026-214668 2026-10-07T09:54:12.687331+00:00 EUVD-2026-214668 https://cve.radiocsirt.org/vuln/fkie_cve-2023-27487 fkie_cve-2023-27487 2026-10-07T09:54:12.687355+00:00

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.

 https://cve.radiocsirt.org/vuln/gsd-2023-27487 gsd-2023-27487 2026-10-07T09:54:12.687403+00:00 gsd-2023-27487 https://cve.radiocsirt.org/vuln/rhsa-2023:4623 RHSA-2023:4623 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update 2026-10-07T09:54:12.687424+00:00

envoy: Client may fake the header `x-envoy-original-path` envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream envoy: Crash when a large request body is processed in Lua filter envoy: envoy doesn't escape HTTP header values envoy: Crash when a redirect url without a state param is received in the oauth filter

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2058 WID-SEC-W-2023-2058 — Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen 2026-10-07T09:54:12.687484+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.