CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 14/09/2026 |
| CVE-2026-54246 | MOYENNE5.7 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in routesrv/routesrv.go, e | 14/09/2026 |
| CVE-2026-50197 | ÉLEVÉE7.8 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody fi | 17/07/2026 |
| CVE-2026-24470 | ÉLEVÉE8.1 | Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach internal services. Versi | 26/01/2026 |
| CVE-2026-23742 | ÉLEVÉE8.8 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline al | 16/01/2026 |
| CVE-2022-38580 | CRITIQUE9.8 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). | 25/10/2022 |
| CVE-2022-34296 | ÉLEVÉE7.5 | In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. | 23/06/2022 |