No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
Newly collected advisory
CVE-2026-115807
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
Newly collected advisory
CVE-2026-114429
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114194
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114693
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114179
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114694
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability
Newly collected advisory
CVE-2026-114190
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114697
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
Newly collected advisory
CVE-2026-110892
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114695
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114178
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-112844
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
Newly collected advisory
CVE-2026-114705
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-112869
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityaccel/amdxdna: Disable device buffer exporting
Advisory content revised
CVE-2026-98436
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securityamt: send the relay's General Query directly from the receive path
Advisory content revised
CVE-2026-98968
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
Newly collected advisory
CVE-2026-110956
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybnxt_en: fix DMA mapping length for padded small packets
Advisory content revised
CVE-2026-99081
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
Advisory content revised
CVE-2026-98383
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: Infer zext_dst based on static register liveness analysis
Advisory content revised
CVE-2026-98869
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: Reject dev-bound-only programs on other devices
Advisory content revised
CVE-2026-98382
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: Skip unsettled links in link iterator
Advisory content revised
CVE-2026-98378
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: Use array_map_meta_equal for percpu array inner map replacement
Advisory content revised
CVE-2026-98376
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securitybpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
Advisory content revised
CVE-2026-98543
Advisory content revised; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.