zalando

Records10All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

zalando records in CISA KEV

No zalando vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in Skipper · all components

TI-2022-18154 CVE-2022-38580 · GHSA-f2rj-m42r-6jm2

HIGH 65

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15892 Published 2022-10-24 Fixed in 0.13.237 CWE-918

TI-2026-19115 CVE-2026-23742 · GHSA-cc8m-98fm-rc9g

MEDIUM 41

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00514 Published 2026-01-16 Fixed in 0.23.0 CWE-250

TI-2026-19725 CVE-2026-24470 · GHSA-mxxc-p822-2hx9

LOW 37

Skipper is an HTTP router and reverse proxy for service composition.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-01-26 Fixed in 0.24.0 CWE-441

TI-2022-15208 CVE-2022-34296 · GHSA-qx2j-85q5-ffp8

LOW 35

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0115 Published 2022-06-22 Fixed in 0.13.218