ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695741 source statements · aliases may refer to the same vulnerability

CVE-2026-109315Published

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109310Published

SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-52394Published

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

cve-program ·

Vendor product: n/a

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109300Published

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.1 · CVSS 3.1 4.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106016Published

Mitigation bypass in the File Handling component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109779Published

Race condition in the Networking: DNS component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109773Published

Denial-of-service in the Sync component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109771Published

Information disclosure in the WebRTC: Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109769Published

Information disclosure in the Networking: Cache component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109768Published

Denial-of-service in the Site Reports component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109761Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109749Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109748Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109735Published

Use-after-free in the DOM: Animation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109280Published

ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109305Published

Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

cve-program ·

Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109275Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109270Published

ImageMagick before 7.1.2-32 Memory Leak via -process Option

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109265Published

ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109255Published

FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.1 · CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109250Published

FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.0 · CVSS 3.1 6.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109245Published

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.4 · CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108382Published

dataclasses-avroschema allows code injection through generated enum-symbol string literals

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109240Published

FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-61642Published

Squid Request Smuggling in HTTP Transfer-Encoding

cve-program ·

Vendor product: squid

CVSS 3.1 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-103030Published

Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

cve-program ·

Vendor product: dio

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109340Published

SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

cve-program ·

Vendor product: surrealdb

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-55823Published

Frappe: Possibility of SQL injection in reportview

cve-program ·

Vendor product: frappe

CVSS 4.0 8.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84317Published

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108377Published

dataclasses-avroschema allows code injection through generated Meta.schema_name

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109568Published

Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes

cve-program ·

Vendor product: Shaark

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109558Published

EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

cve-program ·

Vendor product: EdgeEver

CVSS 4.0 8.5 · CVSS 3.1 8.7Source modified 13 Oct 2026Recorded 23 Oct 2026

MAL-2026-17851Published

Malicious code in yoodan-github-single-ver-pkg (npm)

osv · GHSA-2946-w5c6-hcw2

npm: yoodan-github-single-ver-pkg

Source modified 13 Oct 2026Recorded 24 Oct 2026

CVE-2026-109378Published

SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

cve-program ·

Vendor product: SPIP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109345Published

DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2024-58389Published

HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter

cve-program ·

Vendor product: Panel

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109350Published

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

cve-program ·

Vendor product: gix-pack

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2020-9287Published

A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable

cve-program ·

Vendor product: FortiClientEMS

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2020-9290Published

A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable

cve-program ·

Vendor product: FortiClientWindows

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2019-5589Published

A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable

cve-program ·

Vendor product: FortiClientWindows

CVSS 3.1 8.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2020-37279Published

easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

cve-program ·

Vendor product: easy-pdf-merge

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84314Published

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

cve-program ·

Vendor product: nginx-ui

CVSS 4.0 8.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109355Published

LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List

cve-program ·

Vendor product: librenms

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108928Published

itsourcecode Online Admission System sum.php sql injection

cve-program ·

Vendor product: Online Admission System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109360Published

MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

cve-program ·

Vendor product: MONAI

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109365Published

Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

cve-program ·

Vendor product: zebra

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109374Published

ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

cve-program ·

Vendor product: zitadel

CVSS 4.0 5.1 · CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108375Published

dataclasses-avroschema allows code injection through generated field-default literals

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-41504Published

OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

cve-program ·

Vendor product: coraza

CVSS 3.1 5.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110099Published

Jorani before 1.0.4 Missing Authorization in HR Export Actions

cve-program ·

Vendor product: Jorani

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.