ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698713 source statements · aliases may refer to the same vulnerability

CVE-2026-71379Published

Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 10.0 · CVSS 4.0 10.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-70356Published

Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.1 · CVSS 4.0 9.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-72510Published

Toptech TMS7 and TopHAT SQL Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.0 · CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-63713Published

Toptech TMS7 and TopHAT SQL Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.0 · CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-68954Published

Toptech TMS7 and TopHAT SQL Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.0 · CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-68068Published

Toptech TMS7 and TopHAT SQL Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.0 · CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-72507Published

Toptech TMS7 and TopHAT SQL Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 9.0 · CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-71302Published

Toptech TMS7 and TopHAT Session Fixation

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 7.1 · CVSS 4.0 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-69662Published

Toptech TMS7 and TopHAT Eval Injection

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 3.7 · CVSS 4.0 2.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-71189Published

Toptech TMS7 and TopHAT Cross-site Scripting

cve-program ·

Vendor product: TMS7 · Vendor product: TopHAT

CVSS 3.1 3.5 · CVSS 4.0 4.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86128Published

Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86132Published

Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86136Published

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86105Published

Fireware OS Improper Authorization in Access Portal Reverse Proxy

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-18105Published

Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-90441Published

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86133Published

Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-13224Published

Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86101Published

Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86104Published

Fireware OS Resource Exhaustion in Login Process Allows Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-78229Published

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.

cve-program ·

Vendor product: Image Scanner Driver for Linux (fi Series) · Vendor product: Image Scanner Driver for Linux (SP Series)

CVSS 3.1 6.7 · CVSS 4.0 5.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-96649Published

Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

cve-program ·

Vendor product: Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms

CVSS 3.1 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-89294Published

Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter

cve-program ·

Vendor product: Simply Schedule Appointments

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-6172Published

Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter

cve-program ·

Vendor product: Bold Page Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-88037Published

Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title

cve-program ·

Vendor product: Bold Page Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-11895Published

HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting

cve-program ·

Vendor product: HT Mega Addons for Elementor – Elementor Widgets & Template Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-14876Published

Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block

cve-program ·

Vendor product: Smart Slider 3

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-6171Published

Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

cve-program ·

Vendor product: Bold Page Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-6806Published

Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

cve-program ·

Vendor product: Motors – Car Dealership & Classified Listings Plugin

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-6170Published

Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute

cve-program ·

Vendor product: Bold Page Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-16596Published

WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

cve-program ·

Vendor product: WP Directory Kit

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-6173Published

Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

cve-program ·

Vendor product: Bold Page Builder

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92871Published

A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 7.5 · CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102454Published

DigiWin｜EasyFlow .NET - Arbitrary File Upload

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-97347Published

Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

cve-program ·

Vendor product: Post Views Stats Counter

CVSS 3.1 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2025-14564Published

Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

cve-program ·

Vendor product: Viable URL Media Uploader

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-75098Published

Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

cve-program ·

Vendor product: Product Designer App

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92712Published

ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter

cve-program ·

Vendor product: ReactPress – Create React App for WordPress

CVSS 3.1 6.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102455Published

DigiWin｜EasyFlow .NET - Insecure Deserialization

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102456Published

DigiWin｜EasyFlow .NET - SQL Injection

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102457Published

DigiWin｜EasyFlow .NET - Arbitrary File Read

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102458Published

DigiWin｜EasyFlow .NET - Missing Authentication

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102459Published

DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

cve-program ·

Vendor product: EasyFlow .NET

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102584Published

Moodle: missing capability check allows unauthorised grade penalty recalculation

cve-program ·

https://git.moodle.org: moodle

CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102585Published

Moodle: group validation missing when enrolling user to course

cve-program ·

https://git.moodle.org: moodle

CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102586Published

Moodle: xss via password reset link due to insufficient username escaping

cve-program ·

https://git.moodle.org: moodle

CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102587Published

Moodle: user list filters bypass profile field visibility

cve-program ·

https://git.moodle.org: moodle

CVSS 3.1 2.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102588Published

Moodle: csrf in xml grade import

cve-program ·

https://git.moodle.org: moodle

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-13720Published

Editor can forge file-provisioning provenance on dashboards via the dashboard API

cve-program ·

Vendor product: Grafana OSS · Vendor product: Grafana Enterprise

CVSS 3.1 5.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-76992Published

Uncontrolled Memory Allocation in CODESYS Gateway Client

cve-program ·

Vendor product: Development System 3 · Vendor product: Gateway · Vendor product: Edge Gateway for Windows

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.