Weekly briefing Week 2026-W43
Weekly briefing Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
← Week 42 Last 7 days Week 44 →
Briefing All changes Upcoming dates Source inventory Coverage
All dated changes in this period2282 source records · 1649 groups
23 Oct 2026
Security Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 3 source records
Affected-version evidence changed · 3 entries
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns Affected-version evidence changed
CVE-2026-114406
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns Affected-version evidence changed
CVE-2026-114406
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns Affected-version evidence changed
CVE-2026-114406
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Camunda Broken Access Control via Cockpit
Affected-version evidence changed
CVE-2026-109433
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Command Execution via Admin Console Input in Okta Access Gateway
Newly collected advisory
CVE-2026-115547
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
Newly collected advisory
CVE-2026-53942
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
Newly collected advisory
CVE-2026-114357
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
Affected-version evidence changed
CVE-2026-96293
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Firmware verification vulnerability 2 source records
Newly collected advisory · 2 entries
Firmware verification vulnerability Newly collected advisory
CVE-2026-55981
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
Firmware verification vulnerability Newly collected advisory
CVE-2026-63243
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Fortinet
Revised by Microsoft · Fortinet PSIRT advisories
Assessment context Changed after ChangeIntel first saw it
23 Oct 2026
Security GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx
Affected-version evidence changed
CVE-2026-48530
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security GFI Archiver < 15.14 Stored XSS via MailInsights.aspx 2 source records
Affected-version evidence changed · 2 entries
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx Affected-version evidence changed
CVE-2026-48539
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx Newly collected advisory
CVE-2026-112333
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
Affected-version evidence changed
CVE-2026-108334
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
Newly collected advisory
CVE-2026-55486
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Improper Sanitization leads to Command Injection in AOS-8 Web Interface
Affected-version evidence changed
CVE-2026-79956
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
Affected-version evidence changed
CVE-2026-93017
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Affected-version evidence changed
CVE-2026-18963
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Local Privilege Escalation in CGM CLININET
Newly collected advisory
CVE-2025-30054
Assessment context Newly collected advisory; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
Affected-version evidence changed
CVE-2026-109219
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution
Affected-version evidence changed
CVE-2026-79889
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security NGINX map directive and regex matching vulnerability
Affected-version evidence changed
CVE-2026-93479
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Node.js security announcements
Revised by Microsoft · Node.js security announcements
Assessment context Changed after ChangeIntel first saw it
23 Oct 2026
Security Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
Affected-version evidence changed
CVE-2026-83589
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
Affected-version evidence changed
CVE-2026-85518
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
Affected-version evidence changed
CVE-2026-75888
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
23 Oct 2026
Security Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
Affected-version evidence changed
CVE-2026-75887
Assessment context Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.