Incomplete validation in the run_script Python sandbox in AWS MCP Server
Newly collected advisory
CVE-2026-115845
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Weekly briefing
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
All dated changes in this period
1117 source records · 1002 groupsSecurityInput: ati_remote2 - fix type confusion in device attribute handlers
Input: ati_remote2 - fix type confusion in device attribute handlers
Newly collected advisory
CVE-2026-99069
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityInsecure File Permissions in CGM CLININET
Insecure File Permissions in CGM CLININET
Newly collected advisory
CVE-2025-30051
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityIsar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap
Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap
Newly collected advisory
CVE-2026-55222
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJoomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Newly collected advisory
CVE-2026-102786
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
Newly collected advisory
CVE-2026-89319
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
Newly collected advisory
CVE-2026-89318
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
Newly collected advisory
CVE-2026-89313
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
Newly collected advisory
CVE-2026-89315
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityJwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
Newly collected advisory
CVE-2026-89317
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKEYS: Fix add_key() race with keyring restriction
KEYS: Fix add_key() race with keyring restriction
Newly collected advisory
CVE-2026-99040
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKNIME Analytics Platform logs credentials of configured proxy when used as an executor
KNIME Analytics Platform logs credentials of configured proxy when used as an executor
Newly collected advisory
CVE-2026-115657
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
Newly collected advisory
CVE-2026-98928
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKVM: arm64: nv: Fix life cycle of the nested_mmus array
KVM: arm64: nv: Fix life cycle of the nested_mmus array
Newly collected advisory
CVE-2026-98927
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKVM: s390: Fix IRQ injection with SIGP Stop and Store Status
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
Newly collected advisory
CVE-2026-98930
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKVM: x86: Use active memslots for the per-vCPU MMIO cache
KVM: x86: Use active memslots for the per-vCPU MMIO cache
Newly collected advisory
CVE-2026-99082
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKakao khaiii JSON Config File Linear.cpp open out-of-bounds
Kakao khaiii JSON Config File Linear.cpp open out-of-bounds
Newly collected advisory
CVE-2026-115801
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityKitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)
Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)
Newly collected advisory
CVE-2026-54668
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
Newly collected advisory
CVE-2026-115885
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
Newly collected advisory
CVE-2026-115883
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
Newly collected advisory
CVE-2026-113501
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
Newly collected advisory
CVE-2026-113499
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
Newly collected advisory
CVE-2026-113500
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityLoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
Newly collected advisory
CVE-2026-89316
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.