ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. MC1150662: Action Required – Configure Browser Policy to Preserve OneDrive and SharePoint Web Performance and Offline Capability Community post: Configure Browser Policy to Preserve OneDrive and SharePoint Web Performance and Offline Capability needed for upcoming Chromium versions2 linked entries across history · across 2 areas Follow evidence and connection reasons
  2. KB5048652 · Windows 10, version 21H2 +1 Notice updated: MC1028322: Microsoft Purview | Data Loss Prevention: Support for scoping policies for devices and device group in Endpoint2 linked entries across history · across 2 areas Follow evidence and connection reasons
  3. KB5048667 · Windows 11, version 24H2 +1 Notice updated: MC1028322: Microsoft Purview | Data Loss Prevention: Support for scoping policies for devices and device group in Endpoint2 linked entries across history · across 2 areas Follow evidence and connection reasons
  4. Microsoft 365 admin center: Users may be unable to connect to multiple Microsoft 365 services Ongoing incident19 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  5. Panic on two-block frames in github.com/klauspost/compress Advisory content revised: compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores …8 linked entries across history · in Security Follow evidence and connection reasons
  6. Jira Software Data Center: DoS (Denial of Service) undici Dependency (CVE-2026-19534) Advisory content revised: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101…8 linked entries across history · in Security Follow evidence and connection reasons
  7. undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent Advisory content revised: undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to ea…7 linked entries across history · in Security Follow evidence and connection reasons
  8. undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects Advisory content revised: undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key…7 linked entries across history · in Security Follow evidence and connection reasons
  9. ASP.NET Core Denial of Service Vulnerability Advisory content revised: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  10. kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi Advisory content revised: kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number…4 linked entries across history · in Security Follow evidence and connection reasons
  11. kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter in github.com/getkin/kin-openapi Advisory content revised: kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauth…4 linked entries across history · in Security Follow evidence and connection reasons
  12. kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash in github.com/getkin/kin-openapi Advisory content revised: kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though load…4 linked entries across history · in Security Follow evidence and connection reasons
  13. Go JOSE: DoS when parsing JWKs that contain RSA keys Advisory content revised: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jos…4 linked entries across history · in Security Follow evidence and connection reasons
  14. Device identity management Guidance changed3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  15. WordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  16. A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.… Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  17. frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  18. lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt Advisory content revised: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows del…2 linked entries across history · in Security Follow evidence and connection reasons
  19. Teams network preparation Guidance changed2 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  20. Windows 10 Extended Security Updates Guidance changed2 linked entries across history · in Windows Follow evidence and connection reasons
  21. In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb… Advisory content revised: In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between …7 linked entries across history · in Security Follow evidence and connection reasons
  22. Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore Advisory content revised: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v…6 linked entries across history · in Security Follow evidence and connection reasons
  23. ASP.NET Core Denial of Service Vulnerability Advisory content revised: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  24. ASP.NET Core Elevation of Privilege Vulnerability Advisory content revised: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  25. ASP.NET Core Denial of Service Vulnerability Advisory content revised: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  26. ASP.NET Core Security Feature Bypass Vulnerability Advisory content revised: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  27. ASP.NET Core Denial of Service Vulnerability Advisory content revised: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.6 linked entries across history · in Security Follow evidence and connection reasons
  28. Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service Advisory content revised: Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Ups…5 linked entries across history · in Security Follow evidence and connection reasons
  29. ASP.NET Core Denial of Service Vulnerability Advisory content revised: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.5 linked entries across history · in Security Follow evidence and connection reasons
  30. zip: AES Entry HMAC Authentication Bypass on Premature EOF Advisory content revised: zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bo…4 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 12:08 UTC · 274 of 275 readable · 272 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.