phpIPAM index.php cross site scripting
Newly collected advisory
CVE-2026-115981
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Weekly briefing
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
All dated changes in this period
1120 source records · 1005 groupsSecuritysctp: discard the rest of the packet on a stale-cookie error
sctp: discard the rest of the packet on a stale-cookie error
Source changes critical severity rating
CVE-2026-98548
Assessment context
Source changes critical severity rating; observed by ChangeIntel, not the original publication date.
Securitytcp: prevent collapsing skbs across boundary in rtx queue
tcp: prevent collapsing skbs across boundary in rtx queue
Source changes critical severity rating
CVE-2026-98549
Assessment context
Source changes critical severity rating; observed by ChangeIntel, not the original publication date.
Securityyudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
Newly collected advisory
CVE-2026-116016
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityyudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
Newly collected advisory
CVE-2026-116015
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityAdvanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
Newly collected advisory
CVE-2026-107887
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityArbitrary file read and backend crash through unrestricted provider method calls
Arbitrary file read and backend crash through unrestricted provider method calls
Advisory content revised
CVE-2026-115931
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBOLA Allows Cross-Project Target Tampering
BOLA Allows Cross-Project Target Tampering
Newly collected advisory
CVE-2026-115994
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
Advisory content revised
CVE-2023-7356
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: ISO: Reject concurrent BIS listener setup
Bluetooth: ISO: Reject concurrent BIS listener setup
Advisory content revised
CVE-2026-99013
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: ISO: Serialize concurrent connect calls
Bluetooth: ISO: Serialize concurrent connect calls
Advisory content revised
CVE-2026-99012
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
Advisory content revised
CVE-2026-99011
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: hci_sync: Fix command skb lifetime during scan setup
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
Advisory content revised
CVE-2026-99014
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBluetooth: mgmt: fix race in read_unconf_index_list()
Bluetooth: mgmt: fix race in read_unconf_index_list()
Advisory content revised
CVE-2026-98456
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityBroken access control in JiraController
Broken access control in JiraController
Newly collected advisory
CVE-2026-115975
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCisco
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Security news · Cisco security advisories
SecurityDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
Newly collected advisory
CVE-2026-112207
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEDAC/altera: Fix use-after-free in error paths
EDAC/altera: Fix use-after-free in error paths
Advisory content revised
CVE-2026-98932
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityFront End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
Newly collected advisory
CVE-2026-87835
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
Newly collected advisory
CVE-2026-113673
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
Newly collected advisory
CVE-2026-113493
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
Newly collected advisory
CVE-2026-113489
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
Newly collected advisory
CVE-2026-113491
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
Newly collected advisory
CVE-2026-113674
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.