Priority CRITICAL 99KEV
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.82641 · Published 2026-10-22 · Partial fix · 1.0.10, 1.1.1 +2 CWE-252
Priority LOW 34
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00329 · Published 2026-05-07 · Partial fix · 1.28.6, 1.29.2 +1 CWE-918
Priority LOW 24
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00209 · Published 2026-04-15 · Partial fix · 1.28.6, 1.29.2 +1 CWE-185
Priority LOW 36
Istio is an open platform to connect, manage, and secure microservices.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00251 · Published 2026-03-10 · Partial fix · 1.29.1, 1.28.5 +1 CWE-863
Priority MEDIUM 44
Istio is an open platform to connect, manage, and secure microservices.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0044 · Published 2026-03-10 · Partial fix · 1.29.1, 1.28.5 +1 CWE-200
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority LOW 34
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.6· Adjacent network · Low privileges · No interaction · EPSS 0.00531 · Published 2022-11-10 · Fixed in 1.15.3 CWE-863
Priority MEDIUM 42
Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01436 · Published 2022-10-13 · Partial fix · 1.13.9, 1.14.5 +1 CWE-400
Priority MEDIUM 44
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01192 · Published 2022-06-09 · Partial fix · 1.12.18, 1.13.5 +1 CWE-125
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01591 · Published 2022-03-10 · Partial fix · 1.12.5, 1.13.2 CWE-400
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01651 · Published 2022-02-22 · Fixed in 1.13.1, 1.12.4 +1 CWE-287
Priority LOW 39
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00767 · Published 2022-01-19 · Partial fix · 1.12.2 CWE-863
Priority MEDIUM 45
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0107 · Published 2022-01-19 · Partial fix · 1.12.2 CWE-670
Priority LOW 38
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.01177 · Published 2021-08-24 · Fixed in 1.9.8, 1.10.4 +1 CWE-863
Priority LOW 39
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.01242 · Published 2021-08-24 · Fixed in 1.10.4, 1.11.1 +1 CWE-178
Priority MEDIUM 42
Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01988 · Published 2021-06-29 · No fix listed
Priority MEDIUM 45
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01454 · Published 2021-06-02 · Fixed CWE-862
Priority LOW 32
Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01316 · Published 2021-05-27 · Fixed CWE-706
Priority LOW 32
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01345 · Published 2021-01-29 · Fixed CWE-476
Priority LOW 32
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · No interaction · EPSS 0.01095 · Published 2020-10-01 · Fixed in 1.5.9, 1.6.8 CWE-284
Priority LOW 37
Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02389 · Published 2020-06-02 · Fixed in 1.4.9, 1.5.4 CWE-476
Priority LOW 19
Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue.
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.01818 · Published 2020-04-15 · No fix listed
Priority LOW 35
An issue was discovered in Istio 1.3 through 1.3.6.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01065 · Published 2020-02-14 · No fix listed CWE-20
Priority LOW 37
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.02627 · Published 2020-02-12 · Fixed CWE-287
Priority LOW 35
Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01214 · Published 2019-11-12 · Fixed in 1.3.5 CWE-835
Load more
THREATIST.IORead the docs