Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699219 source statements · aliases may refer to the same vulnerabilityEnvoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
osv · BIT-envoy-gateway-2026-53719 · CVE-2026-53719 · GO-2026-6009
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53719 · CVE-2026-53719 · GHSA-m2v6-2jmh-4c68
Go: github.com/envoyproxy/gateway
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
osv · BIT-envoy-gateway-2026-53716 · CVE-2026-53716 · GO-2026-6006
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53716 · CVE-2026-53716 · GHSA-cxpq-8v7q-cg56
Go: github.com/envoyproxy/gateway
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
osv · BIT-envoy-gateway-2026-53718 · CVE-2026-53718 · GO-2026-6007
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53718 · CVE-2026-53718 · GHSA-fcrp-7gc2-93g7
Go: github.com/envoyproxy/gateway
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
osv · BIT-envoy-gateway-2026-53713 · CVE-2026-53713 · GO-2026-6011
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53713 · CVE-2026-53713 · GHSA-wcrf-9vrr-854f
Go: github.com/envoyproxy/gateway
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
osv · BIT-envoy-gateway-2026-53717 · CVE-2026-53717 · GO-2026-6008
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53717 · CVE-2026-53717 · GHSA-h7pq-86h8-rp5x
Go: github.com/envoyproxy/gateway
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode
osv · BIT-envoy-gateway-2026-53714 · CVE-2026-53714 · GO-2026-6003
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53714 · CVE-2026-53714 · GHSA-22xc-xg2r-9j7v
Go: github.com/envoyproxy/gateway
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
osv · BIT-envoy-gateway-2026-53715 · CVE-2026-53715 · GO-2026-6005
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53715 · CVE-2026-53715 · GHSA-8fv2-88gg-hm7q
Go: github.com/envoyproxy/gateway
Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
osv ·
crates.io: imbl-sized-chunks
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
osv ·
crates.io: ringbuf
Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
osv ·
crates.io: owned-alloc
Org.keycloak.authentication: two factor authentication bypass
cve-program ·
https://www.keycloak.org/: keycloak · https://access.redhat.com/downloads/content/package-browser/: org.keycloak.authentication · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle
Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak
cve-program ·
https://github.com/keycloak/keycloak/: keycloak · https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle
Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
cve-program ·
https://github.com/keycloak/keycloak: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle
Org.keycloak.protocol.services: keycloak hostname verification
cve-program ·
https://www.keycloak.org/: keycloak · https://access.redhat.com/downloads/content/package-browser/: keycloak · https://access.redhat.com/downloads/content/package-browser/: Red Hat build of Keycloak 26
Malicious code in epic-admin-node-services (npm)
osv ·
npm: epic-admin-node-services
Malicious code in epic-adminportal-frontend (npm)
osv ·
npm: epic-adminportal-frontend
Malicious code in egstore-graphql-client (npm)
osv ·
npm: egstore-graphql-client
Malicious code in @epic-mw/localization (npm)
osv · GHSA-4cp8-h6vw-5g96
npm: @epic-mw/localization
Malicious code in element-plus-vite-cli (npm)
osv ·
npm: element-plus-vite-cli
Malicious code in byted-commerce-materials (npm)
osv ·
npm: byted-commerce-materials
Malicious code in @asenfotech/unplugin-element-plus (npm)
osv ·
npm: @asenfotech/unplugin-element-plus
Malicious code in @nimbusedge2/authxsas1 (npm)
osv ·
npm: @nimbusedge2/authxsas1
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.