CVE-2026-73546

A flaw was found in Envoy. The administrative HTML statistics interface does not properly encode dynamic statistic names before displaying them, leading to a stored cross-site scripting XSS vulnerability. A remote attacker can exploit this by sending crafted requests that cause Envoy to store...