Malicious code in @fmr-ap149494/apex-base-component (npm)
Advisory content revised
MAL-2026-17929
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
Weekly briefing
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
All dated changes in this period
1120 source records · 1005 groupsSecurityMalicious code in ccl-global-shopping (npm)
Malicious code in ccl-global-shopping (npm)
Advisory content revised
MAL-2026-18061
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in ing-feat-itsme-oidc-authentication (npm)
Malicious code in ing-feat-itsme-oidc-authentication (npm)
Advisory content revised
MAL-2026-5780
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sc-announcer (npm)
Malicious code in sc-announcer (npm)
Advisory content revised
MAL-2026-18064
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sc-font-icons (npm)
Malicious code in sc-font-icons (npm)
Advisory content revised
MAL-2026-12800
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sc-geeksquad-core (npm)
Malicious code in sc-geeksquad-core (npm)
Advisory content revised
MAL-2026-12435
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sc-wizard (npm)
Malicious code in sc-wizard (npm)
Advisory content revised
MAL-2026-18062
Assessment context
Advisory content revised; observed by ChangeIntel, not the original publication date.
SecurityOracle Database / Oracle E-Business Suite / Oracle Java / Oracle WebLogic Server
Oracle Security Alert CVE-2026-109618
Security advisory · Oracle security alert directory
SecurityBookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
Newly collected advisory
CVE-2026-116020
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCa-certificates: distrust emudhra intermediate ca certificates due to security concerns2 source records
Affected-version evidence changed · 2 entries
- Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
Affected-version evidence changed
CVE-2026-114406
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
- Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
Affected-version evidence changed
CVE-2026-114406
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
Newly collected advisory
CVE-2026-116009
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Newly collected advisory
CVE-2026-116011
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
Newly collected advisory
CVE-2026-116008
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityDistrust compromised intermediate certificates in ssl module
Distrust compromised intermediate certificates in ssl module
Newly collected advisory
CVE-2026-115557
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityFaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
Newly collected advisory
CVE-2026-115973
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
Newly collected advisory
CVE-2026-115972
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityForged signed tokens let any registered user take over other users and organizations
Forged signed tokens let any registered user take over other users and organizations
Newly collected advisory
CVE-2026-115933
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Newly collected advisory
CVE-2026-116012
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
Newly collected advisory
CVE-2026-116019
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityHID: mcp2221: stop device IO before hid_hw_stop
HID: mcp2221: stop device IO before hid_hw_stop
Affected-version evidence changed
CVE-2026-89623
Assessment context
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
Newly collected advisory
CVE-2026-116018
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityOpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing
Newly collected advisory
CVE-2026-116013
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityPath traversal in post media lets any registered user read server files
Path traversal in post media lets any registered user read server files
Newly collected advisory
CVE-2026-115932
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
Newly collected advisory
CVE-2026-115806
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.