Envoy
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 74 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 19, 2019 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Microsoft releases emergency .NET security fixes for Google Brotli bug
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
Envoy: RBAC Authorization Bypass via Path Parameters
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null
Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters
Envoy: oghttp2 upstream trailers incorrect handling
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
Monitor Envoy in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.