ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Jira Software Data Center: File Inclusion postcss Dependency (CVE-2026-73646) Advisory content revised: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(d…2 linked entries across history · in Security Follow evidence and connection reasons
  2. Microsoft Copilot (Microsoft 365): [Copilot Extensibility] Users can create agents scoped on Custom connector containers Cancelled2 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  3. Microsoft Copilot (Microsoft 365): [Copilot Extensibility] User can create agents scoped on specific item/ container using URL Cancelled2 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  4. Outlook: Inline chat for email drafting Date moved later2 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  5. Copilot data, privacy and security Guidance changed4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  6. Microsoft Teams: Admins can control profanity filtering in meeting transcripts Launched4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  7. kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi Newly collected advisory3 linked entries across history · in Security Follow evidence and connection reasons
  8. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http Advisory content revised: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 6…3 linked entries across history · in Security Follow evidence and connection reasons
  9. Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter Advisory content revised: Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-comp…3 linked entries across history · in Security Follow evidence and connection reasons
  10. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch Advisory content revised: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of return…3 linked entries across history · in Security Follow evidence and connection reasons
  11. Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass Advisory content revised: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously…3 linked entries across history · in Security Follow evidence and connection reasons
  12. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call Advisory content revised: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash …3 linked entries across history · in Security Follow evidence and connection reasons
  13. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield Advisory content revised: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function …3 linked entries across history · in Security Follow evidence and connection reasons
  14. Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes Advisory content revised: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length c…3 linked entries across history · in Security Follow evidence and connection reasons
  15. Jira Software Data Center: DoS (Denial of Service) brace-expansion Dependency (CVE-2026-14257) Advisory content revised: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining …3 linked entries across history · in Security Follow evidence and connection reasons
  16. SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel Newly collected advisory3 linked entries across history · in Security Follow evidence and connection reasons
  17. Jira Software Data Center: DoS (Denial of Service) nanoid Dependency (CVE-2026-67213) Advisory content revised: nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefi…3 linked entries across history · in Security Follow evidence and connection reasons
  18. Jira Software Data Center: CSRF (Cross-Site Request Forgery) nanoid Dependency (CVE-2026-73086) Advisory content revised: nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, all…3 linked entries across history · in Security Follow evidence and connection reasons
  19. Out-of-bounds Write in Bootloader Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  20. Outlook: Share Word, Excel, and PowerPoint local files via the new Outlook for Windows Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  21. Microsoft Purview: eDiscovery - In-product diagnostics to troubleshoot common challenges Preview · Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  22. Microsoft Copilot (Microsoft 365): Chat: Access to UBB models via the model selector Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  23. kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  24. kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) in github.com/getkin/kin-openapi Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  25. kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content in github.com/getkin/kin-openapi Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  26. kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression in github.com/getkin/kin-openapi Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  27. Vitess vttablet /twopcz reflected XSS in vitess.io/vitess Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  28. Integer overflow yields an out-of-domain coordinate with nil error, causing panic in github.com/xuri/excelize Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  29. Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics in github.com/xuri/excelize Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  30. Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile in github.com/xuri/excelize Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 14:14 UTC · 274 of 275 readable · 273 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.