ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699698 source statements · aliases may refer to the same vulnerability

CVE-2026-83037Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83042Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83054Published

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Internet Directory

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83060Published

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Internet Directory

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83061Published

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Internet Directory

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83062Published

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Internet Directory

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83066Published

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Internet Directory

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83094Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83095Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83098Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83100Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83108Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83151Published

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Service Delivery Platform

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83232Published

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauth…

cve-program ·

Vendor product: Oracle Data Integrator

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83261Published

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network acces…

cve-program ·

Vendor product: Oracle Product Lifecycle Analytics

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83327Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker w…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83339Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthent…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83355Published

Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: Oracle Enterprise Manager for Fusion Middleware

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83452Published

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle Document Management and Collaboration

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-83462Published

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle Mobile Application Server

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-87188Published

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Hyperion Financial Management

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-73944Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-13166Published

Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

cve-program ·

Vendor product: WSO2 Identity Server

CVSS 3.1 3.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-77179Published

Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

cve-program ·

Vendor product: Docker Sandboxes

CVSS 4.0 9.4Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-2h44-8472-frjjPublished

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

osv · CVE-2026-61559

npm: @zereight/mcp-gitlab

CRITICALSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-10150Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-10149Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-10145Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-vmp7-252j-cwp7Published

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

osv · CVE-2026-61568

npm: @zereight/mcp-gitlab

CRITICALSource modified 15 Sep 2026Recorded 24 Oct 2026

GHSA-5648-rgj9-v224Published

@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS

osv ·

npm: @zereight/mcp-gitlab

HIGHSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-0177Published

In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for expl…

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-0183Published

In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-0197Published

In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-56950Published

In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exp…

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57006Published

In acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-5hq8-qhww-jm7qPublished

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

osv · CVE-2026-61544

crates.io: libp2p-quic

HIGHSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-76169Published

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The inter…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.5Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-84469Published

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to …

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.5Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-84504Published

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the r…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 8.1Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-58721Published

In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-84428Published

fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the r…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.5Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-86733Published

Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

cve-program ·

Vendor product: snipe-it

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76704Published

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 5.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76705Published

Authenticated Buffer Overflow Vulnerability in an API Endpoint Leads to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 5.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76706Published

Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-58200Published

@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

cve-program ·

Vendor product: payload-plugins

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55690Published

EmbedVideo Extension: Stored XSS via unsanitized service name in exception text

cve-program ·

Vendor product: mediawiki-extensions-EmbedVideo

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53710Published

MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

cve-program ·

Vendor product: mcp-context-forge

CVSS 3.1 10.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12752Published

Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026

cve-program ·

Vendor product: Business Automation Workflow containers and traditional

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-44300Published

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

cve-program ·

Vendor product: opencost

CVSS 4.0 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.