ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690091 source statements · aliases may refer to the same vulnerability

CVE-2026-118013Published

Use-after-free in the Layout: Images, Video, and HTML Frames component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118012Published

Use-after-free in the DOM: Animation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118011Published

Frame poisoning in the CSS Parsing and Computation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118010Published

Use-after-free in the Disability Access APIs component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118009Published

Integer overflow, use-after-free in the Graphics: Text component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118007Published

Use-after-free in the JavaScript: GC component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118006Published

Privilege escalation due to use-after-free in the WebRTC: Signaling component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118005Published

Use-after-free in the WebRTC: Signaling component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116469Published

MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

cve-program ·

Vendor product: misp-guard

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118173Published

MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

cve-program ·

Vendor product: misp-guard

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-115413Published

AWS API MCP Server OAuth Token Audience Validation Bypass

cve-program ·

Vendor product: aws-api-mcp-server

CVSS 3.1 7.8 · CVSS 4.0 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-58351Published

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by de…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58356Published

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 6.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58357Published

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliabl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58358Published

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assign…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 4.9Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58359Published

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, cr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58361Published

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58362Published

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGN…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.8Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58363Published

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58364Published

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58365Published

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to tri…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58366Published

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58367Published

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit S…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58368Published

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58369Published

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the Surre…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58370Published

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-118171Published

CVE-2026-118171

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118172Published

CVE-2026-118172

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118170Published

CVE-2026-118170

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57188Published

Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116682Published

FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

cve-program ·

Vendor product: filebrowser

CVSS 3.1 8.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-14255Published

IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products

cve-program ·

Vendor product: Shared Components · Vendor product: Revit

CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-94gr-w3q5-rfqrPublished

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

osv · CVE-2025-65719 · PYSEC-2026-371

npm: kubectl-mcp-server · PyPI: kubectl-mcp-server

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116680Published

Homebox generic notifier SSRF via HTTP redirect after URL validation

cve-program ·

Vendor product: homebox

CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-88812Published

X.Org Server XKB SetGeometry TextDoodad Double Free

cve-program ·

Vendor product: xorg-x11-server · Vendor product: xwayland

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102816Published

Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

cve-program ·

Vendor product: RE305 v3

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102813Published

Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

cve-program ·

Vendor product: RE305 v3

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102812Published

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

cve-program ·

Vendor product: RE305 v3 · Vendor product: Archer C7 v5

CVSS 4.0 6.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18330Published

Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7

cve-program ·

Vendor product: RE305 v3 · Vendor product: Archer C7 v5

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118132Published

CVE-2026-118132

cve-program ·

Vendor product: NextChat

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108311Published

Tanium addressed an insufficient logging vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 2.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108303Published

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

cve-program ·

Vendor product: Certificate Manager

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108316Published

Tanium addressed an information disclosure vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116656Published

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108325Published

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.

cve-program ·

Vendor product: Reputation

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116659Published

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108302Published

Tanium addressed an improper access controls vulnerability in Comply.

cve-program ·

Vendor product: Comply

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108306Published

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: end-user-cx

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108329Published

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

cve-program ·

Vendor product: Threat Response

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108332Published

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: threat-response-cx

CVSS 3.1 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.