ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690461 source statements · aliases may refer to the same vulnerability

CVE-2026-112328Published

Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

cve-program ·

Vendor product: Sensei LMS

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112296Published

FlyCms through commit edfdf724 Default Super Administrator Credentials

cve-program ·

https://github.com/sunkaifei/FlyCms: FlyCms

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112295Published

FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update

cve-program ·

https://github.com/sunkaifei/FlyCms: FlyCms

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112294Published

FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

cve-program ·

https://github.com/sunkaifei/FlyCms: FlyCms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106174Published

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP …

cve-program ·

Vendor product: FortiOS

CVSS 3.1 6.7Source modified 27 Oct 2026Recorded 27 Oct 2026

RUSTSEC-2026-0412Published

Arbitrary code execution when rerunning tests from a portable recording

osv · GHSA-vc25-qg58-w57c

crates.io: cargo-nextest

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82117Published

Authentication Bypass by Spoofing Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82116Published

Missing Authentication for Critical Function Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82118Published

Stack-based Buffer Overflow Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82120Published

Heap-based Buffer Overflow Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82119Published

OS Command Injection Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82121Published

Origin Validation Error Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82122Published

Stack-based Buffer Overflow Vulnerability in HiRDB

cve-program ·

Vendor product: HiRDB Server Version 10 · Vendor product: HiRDB Server Version 9 · Vendor product: HiRDB Server with Additional Function Version 9

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76939Published

Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76936Published

Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76937Published

Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76938Published

Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76935Published

Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76934Published

Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent · Vendor product: JP1/Automatic Job Management System 3 - Agent Minimal Edition

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76932Published

Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent · Vendor product: JP1/Automatic Job Management System 3 - Agent Minimal Edition

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76933Published

Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3

cve-program ·

Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent · Vendor product: JP1/Automatic Job Management System 3 - Agent Minimal Edition

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86577Published

Out-of-bounds Write Vulnerability in JP1 Products

cve-program ·

Vendor product: JP1/Integrated Management 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86576Published

Heap-based Buffer Overflow Vulnerability in JP1 Products

cve-program ·

Vendor product: JP1/Integrated Management 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86575Published

Stack-based Buffer Overflow Vulnerability in JP1 Products

cve-program ·

Vendor product: JP1/Integrated Management 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Manager · Vendor product: JP1/Automatic Job Management System 3 - Agent

CVSS 3.1 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86574Published

Heap-based Buffer Overflow Vulnerability in JP1/Base

cve-program ·

Vendor product: JP1/Base

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107147Published

Authentication bypass by spoofing in twofactor_gauthenticator

cve-program ·

https://github.com: twofactor_gauthenticator

CVSS 4.0 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107146Published

Insufficient session expiration in twofactor_gauthenticator

cve-program ·

https://github.com: twofactor_gauthenticator

CVSS 4.0 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107145Published

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

cve-program ·

https://github.com: twofactor_gauthenticator

CVSS 4.0 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102787Published

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

cve-program ·

Vendor product: Phoca Download extension for Joomla

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102788Published

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 9.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102789Published

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 9.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117494Published

Multiple vulnerabilities in Sisense’s Cloud BI Platform

cve-program ·

Vendor product: Cloud BI Platform

CVSS 4.0 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117493Published

Multiple vulnerabilities in Sisense’s Cloud BI Platform

cve-program ·

Vendor product: Cloud BI Platform

CVSS 4.0 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-85299Published

Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration

cve-program ·

Vendor product: Compute Engine

CVSS 4.0 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65213Published

Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65211Published

Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-3322Published

Privilege escalation via request replaying in Lobster_pro

cve-program ·

Vendor product: Lobster_pro

CVSS 4.0 5.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65210Published

Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 4.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65220Published

Supermicro BMC IPMI feature contains a Privilege escalation vulnerability

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65219Published

Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107157Published

Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework

cve-program ·

Vendor product: Qt

CVSS 4.0 2.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18451Published

Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token

cve-program ·

Vendor product: MBD-X12SPI

CVSS 3.1 3.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18450Published

Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability

cve-program ·

Vendor product: X12SPI

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18449Published

Supermicro BMC contains a SMCRAKP Fixed Key vulnerability

cve-program ·

Vendor product: X12SPI

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107472Published

Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt

cve-program ·

Vendor product: Qt

CVSS 4.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7710Published

YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7679Published

YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-16521Published

Supermicro BMC's syslog feature contains a command injection vulnerability

cve-program ·

Vendor product: MBD-X12STW-F

CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-115975Published

Broken access control in JiraController

cve-program ·

Vendor product: cervantes

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7678Published

YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.