ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699233 source statements · aliases may refer to the same vulnerability

CVE-2026-92063Published

Denial-of-service in the Audio/Video component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92077Published

Denial-of-service in the SVG component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92078Published

Denial-of-service in the Security component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92067Published

Use-after-free in the Widget: Gtk component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92060Published

Use-after-free in the Internationalization component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92056Published

Use-after-free in the Graphics: Text component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92049Published

Use-after-free in the Widget: Win32 component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92058Published

Use-after-free in the Graphics component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92046Published

Use-after-free in the Graphics component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92040Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92029Published

Use-after-free in the SVG component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92028Published

Use-after-free in the DOM: Core & HTML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92024Published

Use-after-free in the SVG component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92023Published

Use-after-free in the XML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92022Published

Use-after-free in the DOM: HTML Parser component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92021Published

Use-after-free in the JavaScript Engine: JIT component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-92018Published

Sandbox escape in the DOM: Core & HTML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-13272Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-71642Published

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback()

cve-program ·

Vendor product: n/a

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-77875Published

Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

cve-program ·

Vendor product: Hide Photos - Secure vault

CVSS 4.0 6.8Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-78030Published

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

cve-program ·

https://cpan.org/modules: DBI

Source modified 20 Sep 2026Recorded 23 Oct 2026

CVE-2026-89155Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-45363Published

`jwt` (Ruby gem) - empty-key HMAC bypass

cve-program ·

Vendor product: ruby-jwt

CVSS 3.1 9.1Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76757Published

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

cve-program ·

https://www.drupal.org/project/gammu_smsd: Gammu SMS Daemon

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76756Published

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

cve-program ·

https://www.drupal.org/project/gammu_smsd: Gammu SMS Daemon

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76755Published

Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

cve-program ·

https://www.drupal.org/project/gammu_smsd: Gammu SMS Daemon

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-61516Published

Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

cve-program ·

Vendor product: NX10

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-86721Published

AVideo through c3edcc274c Authorization Bypass via Session Cookie

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-86726Published

AVideo through 29.0 Information Disclosure via restreamsActive.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-86731Published

Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

cve-program ·

Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-86736Published

snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

cve-program ·

Vendor product: snipe-it

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-86749Published

snipe-it before 8.7.0 Data Loss via Failed Image Write

cve-program ·

Vendor product: snipe-it

CVSS 4.0 7.0 · CVSS 3.1 6.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-90541Published

WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76451Published

Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 4.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76444Published

Cisco Identity Services Engine Information Disclosure Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 5.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76432Published

Cisco Identity Services Engine Arbitrary File Write Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 4.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-20072Published

ISE information disclosure

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 4.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-76431Published

Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 4.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-87935Published

Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action

cve-program ·

Vendor product: Paid Downloads

CVSS 3.1 8.1Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-78296Published

WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability

cve-program ·

https://wordpress.org/plugins: fluent-security

CVSS 3.1 5.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66572Published

WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: JetBlog

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66577Published

WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: JetSearch

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66617Published

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: organize-series

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66626Published

WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: skt-addons-for-elementor

CVSS 3.1 7.6Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-73999Published

WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: cooked

CVSS 3.1 5.4Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-78294Published

WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-81443Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side…

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 6.4Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-81446Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-si…

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 7.4Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-56795Published

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

cve-program ·

Vendor product: Driver Pack For Windows OS · Vendor product: Driver Pack For Linux OS · Vendor product: Server Update Utility, Windows 64-bit format

CVSS 3.1 8.2Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-2585Published

Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter

cve-program ·

Vendor product: Brizy – Page Builder

CVSS 3.1 6.4Source modified 19 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.