Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114641 | low | 3.7 | No | Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where... | 2026-10-28 |
| CVE-2026-114637 | high | 8.7 | No | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fail... | 2026-10-28 |
| CVE-2026-114633 | medium | 6.5 | No | WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify a... | 2026-10-28 |
| CVE-2026-114575 | critical | 10.0 | No | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/c... | 2026-10-28 |
| CVE-2026-114509 | not reported | — | No | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not rej... | 2026-10-28 |
| CVE-2026-114440 | high | 7.3 | No | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipul... | 2026-10-28 |
| CVE-2026-114383 | critical | 10.0 | No | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi... | 2026-10-28 |
| CVE-2026-114380 | medium | 6.3 | No | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Per... | 2026-10-28 |
| CVE-2026-114377 | low | 3.8 | No | A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of t... | 2026-10-28 |
| CVE-2026-114142 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prot... | 2026-10-28 |
| CVE-2026-114374 | medium | 4.3 | No | A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metada... | 2026-10-28 |
| CVE-2026-114268 | critical | 9.9 | No | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/Wif... | 2026-10-28 |
| CVE-2026-114138 | high | 7.5 | No | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negot... | 2026-10-28 |
| CVE-2026-102923 | medium | 5.4 | No | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService... | 2026-10-28 |
| CVE-2020-37284 | medium | 6.1 | No | Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts... | 2026-10-28 |
| CVE-2018-25438 | high | 7.5 | No | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attack... | 2026-10-28 |
| CVE-2026-88152 | high | 7.8 | No | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-98099 | medium | 4.7 | No | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several p... | 2026-10-28 |
| CVE-2023-54366 | high | 8.8 | No | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tab... | 2026-10-28 |
| CVE-2023-37524 | high | 7.8 | No | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Frame... | 2026-10-28 |