PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Newly collected advisory
CVE-2026-57114
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Weekly briefing
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
All dated changes in this period
1117 source records · 1002 groupsSecurityPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Newly collected advisory
CVE-2026-57121
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityPredictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS
Newly collected advisory
CVE-2026-79980
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityProfile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
Newly collected advisory
CVE-2026-111965
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityProfile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
Newly collected advisory
CVE-2026-111966
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityProfile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
Newly collected advisory
CVE-2026-111982
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
Newly collected advisory
CVE-2026-89314
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityRPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header
RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header
Newly collected advisory
CVE-2026-115722
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityReflected Cross-Site Scripting (XSS) in CGM CLININET
Reflected Cross-Site Scripting (XSS) in CGM CLININET
Newly collected advisory
CVE-2025-58403
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityReflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
Newly collected advisory
CVE-2026-4951
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySecret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Newly collected advisory
CVE-2026-105963
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Newly collected advisory
CVE-2026-115897
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityServer-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
Newly collected advisory
CVE-2026-19678
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityServer-side request forgery in the model download path in Amazon Web Services Multi Model Server
Server-side request forgery in the model download path in Amazon Web Services Multi Model Server
Newly collected advisory
CVE-2026-115813
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySignal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Newly collected advisory
CVE-2026-115752
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySmileCDR HAPI FHIR improper data decompression
SmileCDR HAPI FHIR improper data decompression
Advisory content revised
CVE-2026-113873
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecuritySmileCDR HAPI FHIR trusted tenant partition override
SmileCDR HAPI FHIR trusted tenant partition override
Advisory content revised
CVE-2026-113874
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecuritySmileCDR HAPI FHIR unauthorized read via subscription
SmileCDR HAPI FHIR unauthorized read via subscription
Advisory content revised
CVE-2026-113875
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecuritySmileCDR HAPI FHIR unauthorized read
SmileCDR HAPI FHIR unauthorized read
Advisory content revised
CVE-2026-113876
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecuritySnap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
Newly collected advisory
CVE-2026-115723
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySpeed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
Newly collected advisory
CVE-2026-111738
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritySpeed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
Newly collected advisory
CVE-2026-111737
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityStale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
Newly collected advisory
CVE-2026-79979
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityStored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
Newly collected advisory
CVE-2026-4950
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.