No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityUnauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
Affected-version evidence changed
CVE-2026-79852
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
Newly collected advisory
CVE-2026-46651
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUnauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
Affected-version evidence changed
CVE-2026-79871
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityUnauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
Affected-version evidence changed
CVE-2026-79853
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Newly collected advisory
CVE-2026-115889
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Newly collected advisory
CVE-2026-115893
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWeaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Affected-version evidence changed
CVE-2025-71434
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
Newly collected advisory
CVE-2026-107685
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWildfly-core: wildfly: arbitrary file read via malicious archive deployment
Affected-version evidence changed
CVE-2026-24330
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWindows Network Load Balancing Remote Code Execution Vulnerability
Source changes critical severity rating
CVE-2026-83862
Source changes critical severity rating; observed by ChangeIntel, not the original publication date.
SecurityWordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
Affected-version evidence changed
CVE-2026-65529
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
Affected-version evidence changed
CVE-2026-39769
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112853
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112854
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112848
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112851
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112859
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112862
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
Newly collected advisory
CVE-2026-112860
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112855
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112857
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112858
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112846
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112856
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.