ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to p…5 linked entries across history · in Security Follow evidence and connection reasons
  2. Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS#12 MAC or PKCS#12 password-based encryption iteration count of zero or less. pki.pbe.generatePkc…5 linked entries across history · in Security Follow evidence and connection reasons
  3. Forge: AES-GCM authentication bypass via unvalidated tagLength option Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption through forge.cipher.createDec…5 linked entries across history · in Security Follow evidence and connection reasons
  4. Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), fragmented handshake message, interleaved record to process …5 linked entries across history · in Security Follow evidence and connection reasons
  5. Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() u…5 linked entries across history · in Security Follow evidence and connection reasons
  6. Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop Newly collected advisory: Unbounded retries on truncated responses in the name server pool5 linked entries across history · in Security Follow evidence and connection reasons
  7. Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a …4 linked entries across history · in Security Follow evidence and connection reasons
  8. Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections Advisory content revised: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index …4 linked entries across history · in Security Follow evidence and connection reasons
  9. Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state Advisory content revised: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dot…4 linked entries across history · in Security Follow evidence and connection reasons
  10. Mongoose: Prototype pollution via Schema.prototype.virtual() Advisory content revised: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validatio…4 linked entries across history · in Security Follow evidence and connection reasons
  11. Mongoose: Connection-level sanitizeFilter not applied Advisory content revised: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.pro…4 linked entries across history · in Security Follow evidence and connection reasons
  12. Mongoose: sanitizeFilter not applied on countDocuments Advisory content revised: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense…4 linked entries across history · in Security Follow evidence and connection reasons
  13. Forge: TLS client crash on an unsupported ServerHello compression method Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHell…4 linked entries across history · in Security Follow evidence and connection reasons
  14. Forge: ReDoS in forge.http response header and cookie trimming Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie n…4 linked entries across history · in Security Follow evidence and connection reasons
  15. Forge: TLS client crash on a handshake record received without a session Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including afte…4 linked entries across history · in Security Follow evidence and connection reasons
  16. Forge: Ed25519 signature verification accepts small-order public keys Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical enc…4 linked entries across history · in Security Follow evidence and connection reasons
  17. github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction Advisory content revised: The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted…4 linked entries across history · in Security Follow evidence and connection reasons
  18. Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API Advisory content revised: Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/r…3 linked entries across history · in Security Follow evidence and connection reasons
  19. Dagu MCP DAG specification read bypasses path containment and workspace isolation Advisory content revised: Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33…3 linked entries across history · in Security Follow evidence and connection reasons
  20. bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list Advisory content revised: bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes…3 linked entries across history · in Security Follow evidence and connection reasons
  21. Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox Advisory content revised: Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in p…3 linked entries across history · in Security Follow evidence and connection reasons
  22. Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie() Advisory content revised: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path f…3 linked entries across history · in Security Follow evidence and connection reasons
  23. OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document Advisory content revised: OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensi…3 linked entries across history · in Security Follow evidence and connection reasons
  24. Forge: Certificate signature verified with the issuer's RSA signature scheme Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input o…3 linked entries across history · in Security Follow evidence and connection reasons
  25. Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or secu…3 linked entries across history · in Security Follow evidence and connection reasons
  26. Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security de…3 linked entries across history · in Security Follow evidence and connection reasons
  27. gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments Advisory content revised: gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, a…3 linked entries across history · in Security Follow evidence and connection reasons
  28. Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks Advisory content revised: Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, config…3 linked entries across history · in Security Follow evidence and connection reasons
  29. Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  30. Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 23:52 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.