ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Visual Studio Spoofing Vulnerability Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  2. A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device. Affected-version evidence changed: A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.2 linked entries across history · in Security Follow evidence and connection reasons
  3. A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device. Affected-version evidence changed: A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.2 linked entries across history · in Security Follow evidence and connection reasons
  4. Win32k Information Disclosure Vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  5. Windows GDI Information Disclosure Vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  6. RE2JS: Quadratic-time denial of service in re2js lookbehind matching Advisory content revised: RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replac…4 linked entries across history · in Security Follow evidence and connection reasons
  7. Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list Advisory content revised: Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tra…4 linked entries across history · in Security Follow evidence and connection reasons
  8. Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages Advisory content revised: Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the src…4 linked entries across history · in Security Follow evidence and connection reasons
  9. i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string Advisory content revised: i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without r…4 linked entries across history · in Security Follow evidence and connection reasons
  10. Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML Advisory content revised: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server becau…4 linked entries across history · in Security Follow evidence and connection reasons
  11. Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies Advisory content revised: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It…4 linked entries across history · in Security Follow evidence and connection reasons
  12. @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths Advisory content revised: @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make rou…4 linked entries across history · in Security Follow evidence and connection reasons
  13. GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications Advisory content revised: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retain…4 linked entries across history · in Security Follow evidence and connection reasons
  14. GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller Advisory content revised: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses…4 linked entries across history · in Security Follow evidence and connection reasons
  15. graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
  16. systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net Advisory content revised: systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> pa…3 linked entries across history · in Security Follow evidence and connection reasons
  17. systeminformation: Prototype pollution in `networkStats()` via the interface name Advisory content revised: systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it with …3 linked entries across history · in Security Follow evidence and connection reasons
  18. Nomad vulnerable to cross-namespace information disclosure in multiple endpoints Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  19. Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  20. Nomad dispatch payload writes can escape the allocation directory through symlinks Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  21. Unauthenticated RCE vulnerability against ClickHouse Server Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  22. Nomad allocation data migration may allow host directory permission modification via symlink following Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  23. Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  24. Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  25. .NET Information Disclosure Vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  26. Cloud Controller exposes secrets in audit log Newly collected advisory2 linked entries across history · in Security Follow evidence and connection reasons
  27. Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  28. @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY Newly collected advisory: PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY2 linked entries across history · in Security Follow evidence and connection reasons
  29. Microsoft Office Spoofing Vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
  30. Microsoft SQL Server Elevation of Privilege Vulnerability Affected-version evidence changed2 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 09:00 UTC · 274 of 275 readable · 272 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.