Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 07:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

164-72% vs 7-day avg of 596

3 critical, 57 high, 70 medium, 29 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.0	CVE-2026-57210	Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service dadrusdadrus heimdall	NVD	Oct 23 13:17 UTC
CVE-2026-57210Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service Executive summary Heimdall, a cloud native identity-aware proxy and access control decision service, has a flaw that lets attackers spoof client IP addresses by sending crafted forwarding headers. The advisory rates it High with a CVSS v4 base score of 7.0, and affects Heimdall versions up to and including 0.17.16. The fix is to upgrade to version 0.17.17, and the advisory recommends sanitizing forwarding headers at the proxy and avoiding reliance on client IP values for security decisions until patched. Technical summary The flaw is improper input validation of the Forwarded (for= parameter) and X-Forwarded-For headers when the trusted_proxies option is configured, so arbitrary, malformed, or obfuscated values are stored in Request.ClientIPAddresses. The Forwarded parser also splits on commas and semicolons without handling RFC 7239 quoted strings, creating extra malformed entries. The CVSS v4 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N, so the attack is network-reachable with no privileges or user interaction, and exploitation requires trusted_proxies to be set and, for rule-based scenarios, rules that reference the property. Affected versions are stated as less than or equal to 0.17.16 and the patched version is 0.17.17. The advisory's workarounds are to restrict direct access to heimdall to trusted proxies, have the front proxy overwrite rather than append forwarding headers, and avoid security decisions based on Request.ClientIPAddresses until patched. Exploitation in the wild and specific detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dadrus/heimdall/security/adv…/GHSA-38x9-25wx-7fg2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dadrus dadrus heimdall NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.0	CVE-2026-57209	Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service dadrusdadrus heimdall	NVD	Oct 23 13:17 UTC
CVE-2026-57209Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service Executive summary Heimdall, a cloud native identity-aware proxy and access control service, has a flaw that lets an attacker inject fake client IP information into the Forwarded header when it runs in proxy mode. The advisory rates it High with a CVSS v4 base score of 7.0, and it can lead to bypassing IP-based access restrictions on upstream applications. The advisory says the fix is to upgrade to version 0.17.17 or later. Technical summary The flaw is an improper input validation and injection issue (CWE-20, CWE-74) where Heimdall copies the incoming Host header into the Forwarded header without removing commas or semicolons. A remote, unauthenticated attacker can send a crafted Host header to proxy-mode deployments, with no user interaction needed, to add a spoofed for= value that upstream services may trust. Affected versions are stated as 0.17.16 and earlier, and the patched version is 0.17.17. The advisory does not state any workaround. It does not state whether the flaw has been exploited in the wild. Detection guidance beyond the proof-of-concept requests is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dadrus/heimdall/security/adv…/GHSA-4jgr-pg2m-m988 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dadrus dadrus heimdall NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee