No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityZimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
Newly collected advisory
CVE-2026-93638
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityZimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
Newly collected advisory
CVE-2026-50053
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityZimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
Newly collected advisory
CVE-2026-115786
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityamt: send the relay's General Query directly from the receive path
Newly collected advisory
CVE-2026-98968
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityarm64: io: Reject non-user protection in ioremap_prot()
Newly collected advisory
CVE-2026-98923
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securityarm64: kprobes: Allow reentering kprobes while single-stepping
Newly collected advisory
CVE-2026-98888
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
Newly collected advisory
CVE-2026-115481
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: Encoded path traversal bypass in the theme file API
Newly collected advisory
CVE-2026-114622
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
Newly collected advisory
CVE-2026-115479
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
Newly collected advisory
CVE-2026-114624
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure
Newly collected advisory
CVE-2026-114623
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: Public Web API mail-form submission bypasses image CAPTCHA
Newly collected advisory
CVE-2026-115480
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: SQL injection in the admin panel and admin API
Newly collected advisory
CVE-2026-114621
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecuritybaserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
Newly collected advisory
CVE-2026-115457
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybnxt_en: fix DMA mapping length for padded small packets
Newly collected advisory
CVE-2026-99081
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybonding: fix the program leak when XDP is replaced
Newly collected advisory
CVE-2026-98966
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybpf, sockmap: Fix self-redirect copied_seq double-counting
Newly collected advisory
CVE-2026-98925
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
Newly collected advisory
CVE-2026-98963
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: don't stash io_uring encoded data across -EAGAIN
Newly collected advisory
CVE-2026-98960
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: fix xattr replace when multiple xattrs are packed in the same item
Newly collected advisory
CVE-2026-98959
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: free iov when btrfs_uring_read_extent() fails
Newly collected advisory
CVE-2026-98962
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: protect sb_write_pointer() with invalidate lock
Newly collected advisory
CVE-2026-98907
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
Newly collected advisory
CVE-2026-99067
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Securitybtrfs: unlock inode and extent in caller when io_uring read extent fails
Newly collected advisory
CVE-2026-98961
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.