CVE-2026-73546

Envoy 's /stats?format=html admin endpoint is vulnerable to stored XSS because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can embed attacker-controlled path segments into ...

CVE-2026-47204

A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted Connect protocol request to a direct response route. This action causes the envoy.filters.http.grpcstats filter to crash, leading to a denial of servic...