No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityNews Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer
Newly collected advisory
CVE-2026-97352
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityNews Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
Newly collected advisory
CVE-2026-97353
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityOracle Database / Oracle E-Business Suite / Oracle Java / Oracle WebLogic Server2 source records
Security advisory · Oracle security alert directory
Security news · Oracle Security Alerts
SecurityPixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
Newly collected advisory
CVE-2026-105199
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityRISC-V: KVM: Serialize IMSIC attributes with vCPU migration
Advisory content revised
CVE-2026-98465
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityScada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
Newly collected advisory
CVE-2026-115803
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityStored XSS in the “Notes” field of project checklists
Newly collected advisory
CVE-2026-115993
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
Newly collected advisory
CVE-2026-115807
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
Newly collected advisory
CVE-2026-114429
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114194
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114693
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114179
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114694
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability
Newly collected advisory
CVE-2026-114190
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114697
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
Newly collected advisory
CVE-2026-110892
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114695
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-114178
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-112844
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
Newly collected advisory
CVE-2026-114705
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
Newly collected advisory
CVE-2026-112869
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityaccel/amdxdna: Disable device buffer exporting
Advisory content revised
CVE-2026-98436
Advisory content revised; observed by ChangeIntel, not the original publication date.
Securityamt: send the relay's General Query directly from the receive path
Advisory content revised
CVE-2026-98968
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
Newly collected advisory
CVE-2026-110956
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.