No access to your tenant or devices. Every item links to its source. What this means
Showing saved public history. All live sources are unavailable. Items may be stale; check source status.
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
Public sources unavailable. Retained evidence can still be read, but it does not establish current coverage. Check source status.
SecurityCacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)
Newly collected advisory
CVE-2026-46531
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCacti: User Enumeration via Error Messages
Newly collected advisory
CVE-2026-49442
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityChatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Newly collected advisory
CVE-2026-115725
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCode Injection in CGM CLININET
Newly collected advisory
CVE-2025-30045
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack bu…
Newly collected advisory
CVE-2026-115863
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityControl panel only API response emulation replaces "securityKey" and reaches server RCE
Newly collected advisory
CVE-2026-115935
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
Newly collected advisory
CVE-2026-107858
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
Advisory content revised
CVE-2026-105949
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityCustomer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
Newly collected advisory
CVE-2026-55826
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
Newly collected advisory
CVE-2026-114356
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
Newly collected advisory
CVE-2026-114353
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
Newly collected advisory
CVE-2026-114354
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
Newly collected advisory
CVE-2026-114355
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing
Newly collected advisory
CVE-2026-79981
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDataApp links without login expose job information to other user in KNIME Business Hub
Advisory content revised
CVE-2026-115502
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityDenial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
Newly collected advisory
CVE-2026-16762
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDepicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
Newly collected advisory
CVE-2026-113472
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
Newly collected advisory
CVE-2026-112219
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEDAC/altera: Fix use-after-free in error paths
Newly collected advisory
CVE-2026-98932
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityElectron: Mitigation for compromised eMudhra intermediate certificates
Newly collected advisory
CVE-2026-115570
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEntire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
Newly collected advisory
CVE-2026-57208
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEssential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
Newly collected advisory
CVE-2026-110537
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEssential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag
Newly collected advisory
CVE-2026-110510
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityEvent Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import
Newly collected advisory
CVE-2026-55190
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.