ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700869 source statements · aliases may refer to the same vulnerability

CVE-2026-3805Published

use after free in SMB connection reuse

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-3784Published

wrong proxy connection reuse with credentials

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-3783Published

token leak with redirect and netrc

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19931Published

Negotiate ambient user conn reuse

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-1965Published

bad reuse of HTTP Negotiate connection

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18924Published

HTTP/2 server push UAF

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13608Published

OpenLDAP SASL authentication bypass

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12064Published

proto-default skips SSH verification

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11856Published

cross-origin Digest auth state leak

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11586Published

WS Auto-PONG memory exhaustion

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11564Published

Native CA trust persist

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11352Published

QUIC zero-length UDP datagrams busy-loop

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-10536Published

HTTP/2 stream-dependency tree UAF

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-9086Published

Out of bounds read for cookie path

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-15224Published

libssh key passphrase bypass without agent set

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-15079Published

libssh global known_hosts override

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-14819Published

OpenSSL partial chain store policy bypass

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-14524Published

bearer token leak on cross-protocol redirect

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-14017Published

broken TLS options for threaded LDAPS

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-13034Published

No QUIC certificate pinning with GnuTLS

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-10966Published

missing SFTP host verification with wolfSSH

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-10148Published

predictable WebSocket mask

cve-program ·

Vendor product: curl · Vendor product: curl · Vendor product: curl

Source modified 15 Sep 2026Recorded 23 Oct 2026

MAL-2026-16164Published

Malicious code in logs_update (crates.io)

osv ·

crates.io: logs-update

Source modified 15 Sep 2026Recorded 24 Oct 2026

GHSA-fm3f-ch8h-qw8qPublished

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

osv · CVE-2026-81888

npm: @hono/oauth-providers

MODERATESource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-81566Published

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Free and Pro) extension for Joomla

CVSS 4.0 5.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85190Published

Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5

cve-program ·

Vendor product: plg_system_quickindex

CVSS 4.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81565Published

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Free and Pro) extension for Joomla

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-79700Published

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Pro) extension for Joomla

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85189Published

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0

cve-program ·

Vendor product: plg_system_modals

CVSS 4.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81564Published

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Free and Pro) extension for Joomla

CVSS 4.0 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-78375Published

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Free and Pro) extension for Joomla

CVSS 4.0 8.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88853Published

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0

cve-program ·

Vendor product: plg_system_modals

CVSS 4.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85191Published

Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0

cve-program ·

Vendor product: plg_system_tabs

CVSS 4.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-43783Published

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

cve-program ·

Vendor product: macOS

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-64701Published

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

cve-program ·

Vendor product: macOS

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-17156Published

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

cve-program ·

Vendor product: App Connect Enterprise

CVSS 3.1 7.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-75624Published

IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service

cve-program ·

Vendor product: App Connect Enterprise

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-63427Published

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

cve-program ·

Vendor product: Software Fix

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-59569Published

Android ZCC VPN API method privilege escalation

cve-program ·

Vendor product: Client Connector

CVSS 3.1 8.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-25687Published

ZCC race condition in ZPA tunnel handler

cve-program ·

Vendor product: Client Connector

CVSS 3.1 8.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12985Published

Mattermost DCR redirect URI allowlist bypass via improper URL component validation

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.8Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-9wxg-vf3r-56hcPublished

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

osv · CVE-2026-57583

npm: @openzeppelin/wizard · npm: @openzeppelin/wizard-cairo · npm: @openzeppelin/wizard-stellar

LOWSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-60163Published

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.…

cve-program ·

Vendor product: MySQL Server · Vendor product: MySQL Cluster

CVSS 3.1 8.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-2015Published

Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2023-5578Published

Portábilis i-Educar HTTP GET Request agenda_imprimir.php cross site scripting

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-8539Published

Portabilis i-Educar public_distrito_cad.php cross site scripting

cve-program ·

Vendor product: i-Educar

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-8538Published

Portabilis i-Educar novo cross site scripting

cve-program ·

Vendor product: i-Educar

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-63310Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-75944Published

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User

cve-program ·

Vendor product: EOS

CVSS 3.1 2.6 · CVSS 4.0 5.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-75945Published

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

cve-program ·

Vendor product: EOS

CVSS 3.1 2.6 · CVSS 4.0 2.1Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.