Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
Newly collected advisory
CVE-2026-46651
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Weekly briefing
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
All dated changes in this period
2282 source records · 1649 groupsSecurityUnauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
Affected-version evidence changed
CVE-2026-79871
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityUnauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
Affected-version evidence changed
CVE-2026-79853
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Newly collected advisory
CVE-2026-115889
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Newly collected advisory
CVE-2026-115893
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWeaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
Affected-version evidence changed
CVE-2025-71434
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
Newly collected advisory
CVE-2026-107685
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWildfly-core: wildfly: arbitrary file read via malicious archive deployment
Wildfly-core: wildfly: arbitrary file read via malicious archive deployment
Affected-version evidence changed
CVE-2026-24330
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWindows Network Load Balancing Remote Code Execution Vulnerability
Windows Network Load Balancing Remote Code Execution Vulnerability
Source changes critical severity rating
CVE-2026-83862
Assessment context
Source changes critical severity rating; observed by ChangeIntel, not the original publication date.
SecurityWordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
Affected-version evidence changed
CVE-2026-65529
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
Affected-version evidence changed
CVE-2026-39769
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityWordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112853
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112854
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112848
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112851
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112859
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112862
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
Newly collected advisory
CVE-2026-112860
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112855
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112857
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112858
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112846
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112856
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
Newly collected advisory
CVE-2026-112847
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.