ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

689935 source statements · aliases may refer to the same vulnerability

CVE-2026-111054Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-112374. Reason: This candidate is a duplicate of CVE-2026-112374. Notes: All CVE users should reference CVE-2026-112374 instead of this candidate.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104353Published

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105780Published

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104350Published

Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105781Published

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 10.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104351Published

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105779Published

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117514Published

oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57201Published

Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114598Published

Access of resource using incompatible type ('type confusion') in EPICS Base

cve-program ·

Vendor product: EPICS Base

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57194Published

Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114597Published

Improper handling of length parameter inconsistency in EPICS Base

cve-program ·

Vendor product: EPICS Base

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114596Published

Integer overflow or wraparound in EPICS Base

cve-program ·

Vendor product: EPICS Base

CVSS 3.1 8.2 · CVSS 4.0 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114595Published

Integer overflow or wraparound in EPICS Base

cve-program ·

Vendor product: EPICS Base

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57198Published

Asterisk: Possible RED T.140 Heap Buffer Overflow

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 2.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117513Published

oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116674Published

systeminformation: Prototype pollution in `networkStats()` via the interface name

cve-program ·

Vendor product: systeminformation

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57185Published

Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18349Published

SAMA5D44 Fault Injection Vulnerability

cve-program ·

Vendor product: SAMA5D4

CVSS 4.0 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57197Published

Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 7.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109090Published

libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

cve-program ·

Vendor product: libXi

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116672Published

Authlib RFC 7592 examples omit registration-access-token client binding

cve-program ·

Vendor product: authlib

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-f65r-h4g3-3h9hPublished

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

osv · CVE-2026-48797 · PYSEC-2026-291

PyPI: backpropagate · npm: @mcptoolshop/backpropagate

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-796p-j2gh-9m2qPublished

dcap-qvl has Missing Verification for QE Identity

osv · CVE-2026-22696 · PYSEC-2026-326

crates.io: dcap-qvl · npm: @phala/dcap-qvl · npm: @phala/dcap-qvl-web

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109088Published

libXtst RECORD EnableContext Reply Endless Loop

cve-program ·

Vendor product: libXtst

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-64394Published

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108141Published

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave…

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106078Published

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 6.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107671Published

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

cve-program ·

Vendor product: ONE

CVSS 4.0 8.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108142Published

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106077Published

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106076Published

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote …

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 9.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108140Published

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave…

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105477Published

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.

cve-program ·

Vendor product: Agent for Linux

CVSS 4.0 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109431Published

Camunda Missing Authorization in Task Sub-Resources

cve-program ·

Vendor product: Camunda 7

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82984Published

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated n…

cve-program ·

Vendor product: Server

CVSS 3.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77167Published

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions fol…

cve-program ·

Vendor product: server

CVSS 3.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77173Published

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

cve-program ·

Vendor product: Files Confidential

CVSS 3.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-67400Published

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

cve-program ·

Vendor product: Richdocuments

CVSS 3.0 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77171Published

A public shared collective always allowed recipients of the link to create pages.

cve-program ·

Vendor product: Collectives

CVSS 3.0 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77172Published

App passwords were allowed to bypass password confirmation on sensitive endpoints.

cve-program ·

Vendor product: Server

CVSS 3.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87897Published

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT aut…

cve-program ·

Vendor product: whiteboard

CVSS 3.0 4.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82983Published

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) …

cve-program ·

Vendor product: Tables

CVSS 3.0 3.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82986Published

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

cve-program ·

Vendor product: Tables

CVSS 3.0 4.6Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-c8m5-c952-6cm4Published

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

osv · RUSTSEC-2026-0346

crates.io: rustls · crates.io: rustls

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-qq8j-7v2v-3rwpPublished

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

osv · CVE-2026-109855

npm: undici

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-6wfj-92cw-88vgPublished

git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

osv · CVE-2026-110634

npm: git-diff

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-w44r-93j7-qv28Published

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

osv · RUSTSEC-2026-0349

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-h2v8-394m-p7vvPublished

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

osv · RUSTSEC-2026-0348

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-vp88-798v-h67fPublished

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

osv · RUSTSEC-2026-0347

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.