ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698466 source statements · aliases may refer to the same vulnerability

CVE-2026-58415Published

Apache HTTP Server: mod_dav_fs property database read access

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-57941Published

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-56154Published

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-56153Published

Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-48005Published

Apache HTTP Server: mod_auth_digest reauthentication attack

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47360Published

Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-46729Published

Apache HTTP Server: mod_heartmonitor denial of service

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-42528Published

Apache HTTP Server: mod_dav shared lock overflow

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-42356Published

Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

cve-program ·

Vendor product: Apache HTTP Server

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2021-21975Published

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal ad…

cve-program ·

Vendor product: VMware vRealize Operations

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103484Published

pgvector buffer overflow in IVFFlat index build

cve-program ·

Vendor product: pgvector

CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2020-0796Published

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

cve-program ·

Vendor product: Windows 10 Version 1903 for 32-bit Systems · Vendor product: Windows 10 Version 1903 for x64-based Systems · Vendor product: Windows 10 Version 1903 for ARM64-based Systems

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-56660Published

GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2016-1019Published

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71426Published

GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 4.0 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-93832Published

A component of one of the Motorola system applications was

cve-program ·

Vendor product: Setup App

CVSS 4.0 4.8 · CVSS 3.1 4.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71542Published

GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 4.0 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-56661Published

GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2010-2861Published

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) lo…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2018-6882Published

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML v…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102505Published

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp

cve-program ·

https://cpan.org/modules: Imager

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102504Published

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

cve-program ·

https://cpan.org/modules: Imager

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103263Published

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

cve-program ·

Vendor product: tornado

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103259Published

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

cve-program ·

Vendor product: n8n

CVSS 4.0 8.5 · CVSS 3.1 7.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2018-19953Published

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130;…

cve-program ·

Vendor product: QTS · Vendor product: QTS · Vendor product: QTS

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103255Published

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

cve-program ·

Vendor product: n8n

CVSS 4.0 7.1 · CVSS 3.1 9.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103251Published

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

cve-program ·

Vendor product: n8n

CVSS 4.0 7.5 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-64947Published

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

cve-program ·

Vendor product: Pandora FMS

CVSS 4.0 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2010-0738Published

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows rem…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-55230Published

Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character

cve-program ·

Vendor product: Vvveb

CVSS 3.1 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103247Published

n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

cve-program ·

Vendor product: n8n

CVSS 4.0 5.8 · CVSS 3.1 8.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2010-1428Published

The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows r…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103082Published

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: lastudio-element-kit

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-7176Published

Multiple vulnerabilities in Entradium by Crocantickets

cve-program ·

Vendor product: Entradium

CVSS 4.0 4.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-7175Published

Multiple vulnerabilities in Entradium by Crocantickets

cve-program ·

Vendor product: Entradium

CVSS 4.0 4.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-95675Published

D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

cve-program ·

Vendor product: DAP-1360

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80119Published

PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80118Published

PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 8.4 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80117Published

PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 6.9 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80116Published

PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80115Published

PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80114Published

PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80113Published

PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 6.9 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-80112Published

PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys

cve-program ·

Vendor product: PerformanceTest · Vendor product: BurnInTest · Vendor product: OSForensics

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77929Published

ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

cve-program ·

Vendor product: clipbucket-v5

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77928Published

ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

cve-program ·

Vendor product: clipbucket-v5

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77927Published

ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

cve-program ·

Vendor product: clipbucket-v5

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77087Published

Paperclip before 0.3.1 Remote Code Execution via DNS Rebinding

cve-program ·

Vendor product: paperclip

CVSS 4.0 9.4 · CVSS 3.1 9.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-75132Published

WAPT Server SQL Injection via /api/v3/hosts Endpoint

cve-program ·

Vendor product: WAPT

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-7006Published

Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

cve-program ·

Vendor product: Sublime Text 4 · Vendor product: Sublime Text 3

CVSS 4.0 7.0 · CVSS 3.1 7.3Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.