ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences Advisory content revised: Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource p…3 linked entries across history · in Security Follow evidence and connection reasons
  2. traQ: XSS in the User Uploaded File Retrieval API Advisory content revised: traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct bro…3 linked entries across history · in Security Follow evidence and connection reasons
  3. traQ: Privilege escalation by OAuth prompt=none request Advisory content revised: traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set…3 linked entries across history · in Security Follow evidence and connection reasons
  4. isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE) Advisory content revised: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repo…3 linked entries across history · in Security Follow evidence and connection reasons
  5. isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) Advisory content revised: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the res…3 linked entries across history · in Security Follow evidence and connection reasons
  6. isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout Advisory content revised: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. Duri…3 linked entries across history · in Security Follow evidence and connection reasons
  7. ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass) Advisory content revised: ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit propert…3 linked entries across history · in Security Follow evidence and connection reasons
  8. tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS Advisory content revised: tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumu…3 linked entries across history · in Security Follow evidence and connection reasons
  9. tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process Advisory content revised: tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrati…3 linked entries across history · in Security Follow evidence and connection reasons
  10. tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients Advisory content revised: tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client…3 linked entries across history · in Security Follow evidence and connection reasons
  11. Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment Advisory content revised: Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the dir…3 linked entries across history · in Security Follow evidence and connection reasons
  12. Kubeflow Pipelines API server lacks authorization for shared pipeline uploads Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canU…3 linked entries across history · in Security Follow evidence and connection reasons
  13. Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin Advisory content revised: Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks be…3 linked entries across history · in Security Follow evidence and connection reasons
  14. ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header Advisory content revised: ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forw…3 linked entries across history · in Security Follow evidence and connection reasons
  15. Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without…3 linked entries across history · in Security Follow evidence and connection reasons
  16. Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the d…3 linked entries across history · in Security Follow evidence and connection reasons
  17. Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines Advisory content revised: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for m…3 linked entries across history · in Security Follow evidence and connection reasons
  18. Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser Advisory content revised: Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer …3 linked entries across history · in Security Follow evidence and connection reasons
  19. Self-service password reset Guidance changed3 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  20. Microsoft Teams: Chat for organizers and presenters in structured meetings and webinars on Teams Rooms on Windows Now rolling out3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  21. Microsoft Teams: Preloaded video for Teams Events and Meetings Now rolling out3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  22. Microsoft Teams: See more messages on mobile Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  23. Microsoft Purview: DSPM-Copilot Readiness and Data Explorer Date moved later3 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
  24. Wednesday, October 21, 2026 Security Releases Security advisory: Wednesday, November 11, 2026 Security Releases2 linked entries across history · in Security Follow evidence and connection reasons
  25. Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests Affected-version evidence changed: Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests2 linked entries across history · in Security Follow evidence and connection reasons
  26. Podman: untrusted image labels allow auto-update to restart arbitrary systemd units Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  27. Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser Newly collected advisory: Zone file lexer panics on a token of 4096 or more characters2 linked entries across history · in Security Follow evidence and connection reasons
  28. Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  29. Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  30. Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 23:52 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.