Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694708 source statements · aliases may refer to the same vulnerabilityMikroTik RouterOS ipt_SAME.ko same_check integer overflow
cve-program ·
Vendor product: RouterOS
Mercury: Unauthenticated Remote Code Execution via /api/kernels
cve-program ·
Vendor product: mercury
IBM MQ Buffer Overflow
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-oauth
Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/lighthouse-agent-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/lighthouse-coredns-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9
Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/lighthouse-agent-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/lighthouse-coredns-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9
Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-rhel9-operator · https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9
Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-rhel9-operator · https://catalog.redhat.com/software/containers/: rhacm2/subctl-rhel9
Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9
Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
cve-program ·
https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/submariner-addon-rhel9
Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-knative
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
osv ·
Go: github.com/envoyproxy/ai-gateway
IBM MQ Deserialization of Untrusted Data
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-pqc
IBM MQ Buffer Overflow
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
cve-program ·
Vendor product: pi-agent-dashboard
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
cve-program ·
https://wordpress.org/plugins: mapsvg-lite-interactive-vector-maps
Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-tika
WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
cve-program ·
https://wordpress.org/plugins: hivepress
Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-xpath
WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: essential-addons-for-elementor-lite
SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
cve-program ·
Vendor product: Inventory System
Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-http
Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-platform-http
subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
cve-program ·
Vendor product: online-clinic-management-system
Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-cxf
Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-mllp
Dav-ee dairy-management-system add.php mysqli_query sql injection
cve-program ·
Vendor product: dairy-management-system
Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-as2
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
cve-program ·
Vendor product: SGLang
WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: yith-woocommerce-product-bundles
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.