ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document Advisory content revised: OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensi…3 linked entries across history · in Security Follow evidence and connection reasons
  2. Forge: Certificate signature verified with the issuer's RSA signature scheme Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input o…3 linked entries across history · in Security Follow evidence and connection reasons
  3. Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or secu…3 linked entries across history · in Security Follow evidence and connection reasons
  4. Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer Advisory content revised: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security de…3 linked entries across history · in Security Follow evidence and connection reasons
  5. gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments Advisory content revised: gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.go passes attacker-controlled declared lengths and counts to decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, a…3 linked entries across history · in Security Follow evidence and connection reasons
  6. Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks Advisory content revised: Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, config…3 linked entries across history · in Security Follow evidence and connection reasons
  7. Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  8. Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table Advisory content revised3 linked entries across history · in Security Follow evidence and connection reasons
  9. fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags Advisory content revised: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each …3 linked entries across history · in Security Follow evidence and connection reasons
  10. A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrar… Affected-version evidence changed: [CVEID]: CVE-2026-126256 3 linked entries across history · in Security Follow evidence and connection reasons
  11. NocoBase: SSRF in customRequests:send via runtime options.url override Advisory content revised: NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-pr…3 linked entries across history · in Security Follow evidence and connection reasons
  12. Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace Advisory content revised: Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code runni…3 linked entries across history · in Security Follow evidence and connection reasons
  13. Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before con…3 linked entries across history · in Security Follow evidence and connection reasons
  14. Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted p…3 linked entries across history · in Security Follow evidence and connection reasons
  15. node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions Advisory content revised: node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without expli…3 linked entries across history · in Security Follow evidence and connection reasons
  16. Microsoft Teams: Facilitator detects and answers questions Notice updated: MC1409304: (Updated) Microsoft Teams: Facilitator proactively detects and resolves knowledge gaps in meetings3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  17. Microsoft Copilot (Microsoft M365): Delegated prompt publishing for organization prompts Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  18. Microsoft Teams: Report a Message or an External User for Security Concern in Gov Clouds Now rolling out3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  19. Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  20. This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1… Affected-version evidence changed: This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3,…2 linked entries across history · in Security Follow evidence and connection reasons
  21. An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 2… Affected-version evidence changed: An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26…2 linked entries across history · in Security Follow evidence and connection reasons
  22. An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data. Affected-version evidence changed: An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.2 linked entries across history · in Security Follow evidence and connection reasons
  23. A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.… Affected-version evidence changed: A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS S…2 linked entries across history · in Security Follow evidence and connection reasons
  24. This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 2… Affected-version evidence changed: This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3…2 linked entries across history · in Security Follow evidence and connection reasons
  25. A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.… Affected-version evidence changed: A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS S…2 linked entries across history · in Security Follow evidence and connection reasons
  26. A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.… Affected-version evidence changed: A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS S…2 linked entries across history · in Security Follow evidence and connection reasons
  27. A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS T… Affected-version evidence changed: A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.…2 linked entries across history · in Security Follow evidence and connection reasons
  28. KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL. Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  29. Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses Newly collected advisory: Spoofed malformed UDP datagrams abort DNS lookups2 linked entries across history · in Security Follow evidence and connection reasons
  30. Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC Newly collected advisory: NSEC wraparound detection trusted an unvalidated SOA record2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 23:52 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.