ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695275 source statements · aliases may refer to the same vulnerability

CVE-2026-101970Published

Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when multiple-triggered-joins is used

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-101971Published

Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-101999Published

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102000Published

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102011Published

Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link protection is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102013Published

Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 4.4 · CVSS 4.0 6.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102017Published

Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102018Published

Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause routing service disruption when bidirectional PIM is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102019Published

Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102021Published

Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MPLS-TE error processing is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102035Published

Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC-LAG IRB MAC synchronization is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102034Published

Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LAG ICCP MAC synchronization is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102033Published

Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102032Published

Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a denial of service when static MAC IP configurations are present

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

GHSA-7pxr-59rr-hqj2Published

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

osv · CVE-2026-72923

NuGet: Microsoft.OpenApi.YamlReader · NuGet: Microsoft.OpenApi.YamlReader · NuGet: Microsoft.OpenApi.Readers

HIGHSource modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2025-64702Published

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decode…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67716Published

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAut…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67717Published

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67718Published

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a craf…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-2325Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of servi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-28732Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-28759Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a m…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-3495Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.8 · CVSS 3.1 · [email protected] · Primary 4.8Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-3637Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-42081Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated by 3…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1 · CVSS 3.1 · [email protected] · Primary 7.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-42082Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-42083Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI. In NewServer(…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-42459Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticate…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-4273Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-4286Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to check if {{team_id}} was being changed when updating playbooks, allowing users with only {{Manage Playbook Configurations}} permission to change a playbook's team, bypassing …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-43898Published

SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44315Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44316Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-smpolicycontrol/v1/sm-policies handler (HandleCreateSmPolicyRequest) panics with a nil-pointer dereference when a downstream OpenAPI c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44317Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's PCF POST /npcf-policyauthorization/v1/app-sessions handler panics on a single authenticated request whose ascReqData.suppFeat == "1" (enabling traffi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44318Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's BSF PUT /nbsf-management/v1/subscriptions/{subId} handler has an unsynchronized write on the global Subscriptions map. The handler first reads the ma…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44319Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription notifyUri cannot be reached. In PfdChangeNotifier.FlushNotifications(), the notifier…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44320Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer token (e.g. Authorization: B…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44321Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44322Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF PATCH /3gpp-pfd-management/v1/{afId}/transactions/{transId}/applications/{appId} handler panics with a nil-pointer dereference when the upstream …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44323Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler contains a nil-pointer dereference r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44324Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated req…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44325Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level type-confusion bug family. The handler in NFs/nrf/internal/sbi/api_accesstoken.go re…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44326Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can crea…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44327Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OA…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44328Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unco…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44329Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can h…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-44330Published

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can …

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-45242Published

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence i…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-45243Published

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-45244Published

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.