ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision Newly collected advisory: DNSSEC validation cache could reuse an Insecure result for a different name2 linked entries across history · in Security Follow evidence and connection reasons
  2. Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name Newly collected advisory: RRSIG signer name was not checked against the zone of the signed records2 linked entries across history · in Security Follow evidence and connection reasons
  3. Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  4. Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  5. pgEdge Control Plane generates pg_hba.conf with trust authentication for local and loopback connections Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  6. pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  7. pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages Newly collected advisory: pgEdge RAG Server discloses part of the configured provider credential through API error messages2 linked entries across history · in Security Follow evidence and connection reasons
  8. pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  9. pgEdge Go LLM Library discloses provider API key fragments in error messages Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  10. @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  11. A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1… Affected-version evidence changed: A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all…2 linked entries across history · in Security Follow evidence and connection reasons
  12. @hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  13. basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list() Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  14. basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  15. Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  16. Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  17. Replicate Cog 0.23.1 SSRF via cog.File and cog.Path URL Inputs Source changes critical severity rating: Replicate Cog through 0.23.1 SSRF via cog.File and cog.Path URL Inputs2 linked entries across history · in Security Follow evidence and connection reasons
  18. Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  19. Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  20. Microsoft Purview: Information Protection-Auto-labeling per-policy coverage report Roadmap entry5 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  21. Intune network endpoints Guidance changed4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  22. Microsoft Edge: Rewrite by Copilot in Edge is being upgraded to include enterprise data protection compliance standards Date moved later4 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  23. Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable Advisory content revised: Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunn…3 linked entries across history · in Security Follow evidence and connection reasons
  24. Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets Advisory content revised: Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Nam…3 linked entries across history · in Security Follow evidence and connection reasons
  25. esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal Advisory content revised: esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying…3 linked entries across history · in Security Follow evidence and connection reasons
  26. DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 Advisory content revised: DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates t…3 linked entries across history · in Security Follow evidence and connection reasons
  27. Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing Advisory content revised: Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-veri…3 linked entries across history · in Security Follow evidence and connection reasons
  28. croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive Advisory content revised: croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a …3 linked entries across history · in Security Follow evidence and connection reasons
  29. `http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
  30. ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 23:52 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.