Weekly briefing

Updates and guidanceMicrosoft Graph6 source records

Graph announcement revised · 2 passages · 6 entries

• Calendars | Places (v1.0): 2 API change passages

  Graph announcement revised · 2 passages · Microsoft Graph monthly changes

  Assessment context

  The publisher announcement changed after collection; compare its recorded group text, without assuming individual passage continuity.

• Graph changes

  Guidance changed

  10 new passages (about 310 words). The changed wording mentions prerequisites, permissions, supported platforms, settings and controls. Review the source to confirm the effect.

  Assessment context

  10 new passages (about 310 words). The changed wording mentions prerequisites, permissions, supported platforms, settings and controls. Review the source to confirm the effect. · Observed documentation change; policy effect and environment availability need review.

• Identity and access | Governance (beta): 4 API change passages

  Graph announcement revised · 4 passages · Microsoft Graph monthly changes

  Assessment context

  The publisher announcement changed after collection; compare its recorded group text, without assuming individual passage continuity.

Updates and guidanceOkta: 38 lists changed

SecurityBookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

SecurityCa-certificates: distrust emudhra intermediate ca certificates due to security concerns2 source records

Affected-version evidence changed · 2 entries

• Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

  Affected-version evidence changed

  CVE-2026-114406

  Assessment context

  Affected-version evidence changed; observed by ChangeIntel, not the original publication date.

• Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

  Affected-version evidence changed

  CVE-2026-114406

  Assessment context

  Affected-version evidence changed; observed by ChangeIntel, not the original publication date.

SecurityCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action

SecurityCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

SecurityDaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

SecurityDistrust compromised intermediate certificates in ssl module

SecurityFaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

SecurityFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization

SecurityForged signed tokens let any registered user take over other users and organizations

SecurityGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

SecurityGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

SecurityHID: mcp2221: stop device IO before hid_hw_stop

SecurityONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

SecurityOpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

SecurityPath traversal in post media lets any registered user read server files

SecurityPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

SecurityRISC-V: KVM: Synchronize hrtimer callback during teardown

SecurityRosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

SecurityTravisun Opptrix Import Endpoint import code injection

SecurityTravisun Opptrix Schedule API setup command injection

SecurityTravisun Opptrix preParsing handler webhook Buffer.concat denial of service

SecurityVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17…