No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityStored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
Newly collected advisory
CVE-2026-4952
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
Newly collected advisory
CVE-2026-112342
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Newly collected advisory
CVE-2026-115810
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTenda F6 Web Management cleartext transmission
Newly collected advisory
CVE-2026-115797
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTenda F6 Web Management cross-site request forgery
Newly collected advisory
CVE-2026-115796
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTokio: Race condition in `tokio::time::Interval`
Newly collected advisory
CVE-2026-115567
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Advisory content revised
CVE-2026-114392
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Advisory content revised
CVE-2026-114400
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityTwisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Newly collected advisory
CVE-2026-83813
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTwisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Newly collected advisory
CVE-2026-115774
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTwisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Newly collected advisory
CVE-2026-115877
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTwisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Newly collected advisory
CVE-2026-115776
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTwisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Newly collected advisory
CVE-2026-115778
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityTwisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Newly collected advisory
CVE-2026-115775
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUbiquitousLearning mllm Convertor __init__.py load_model path traversal
Newly collected advisory
CVE-2026-115800
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUnauthenticated payment reuse allows unpaid orders to be marked as paid
Newly collected advisory
CVE-2026-115937
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Newly collected advisory
CVE-2026-58497
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUse of Unsalted MD5 Password Hashes in CGM CLININET
Newly collected advisory
CVE-2025-30049
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityUse-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt
Newly collected advisory
CVE-2026-95620
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityVLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
Newly collected advisory
CVE-2026-115724
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityVvveb: Path Traversal in nextRestore() and nextBackup()
Newly collected advisory
CVE-2026-112904
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
Newly collected advisory
CVE-2026-115892
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
Newly collected advisory
CVE-2026-79977
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityWordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability
Newly collected advisory
CVE-2026-112825
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.