Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114141 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler... | 2026-10-23 |
| CVE-2026-114375 | medium | 6.3 | No | A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/... | 2026-10-23 |
| CVE-2026-112381 | medium | 5.9 | No | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origi... | 2026-10-23 |
| CVE-2026-111817 | medium | 5.3 | No | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers... | 2026-10-23 |
| CVE-2026-114266 | medium | 6.3 | No | A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query o... | 2026-10-23 |
| CVE-2026-111810 | high | 7.5 | No | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a reque... | 2026-10-23 |
| CVE-2026-111808 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects... | 2026-10-23 |
| CVE-2026-111805 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affec... | 2026-10-23 |
| CVE-2026-111804 | high | 8.2 | No | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-suppli... | 2026-10-23 |
| CVE-2026-109299 | medium | 6.5 | No | Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission t... | 2026-10-23 |
| CVE-2026-109298 | medium | 6.5 | No | Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that exp... | 2026-10-23 |
| CVE-2026-109297 | medium | 6.5 | No | Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily freq... | 2026-10-23 |
| CVE-2026-109296 | medium | 4.3 | No | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider bac... | 2026-10-23 |
| CVE-2026-109295 | medium | 4.3 | No | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall... | 2026-10-23 |
| CVE-2026-109294 | medium | 6.5 | No | Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust... | 2026-10-23 |
| CVE-2026-108358 | not reported | — | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScann... | 2026-10-23 |
| CVE-2026-108357 | not reported | — | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored... | 2026-10-23 |
| CVE-2026-105945 | not reported | — | No | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem sto... | 2026-10-23 |
| CVE-2026-109290 | high | 8.7 | No | Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated us... | 2026-10-23 |
| CVE-2026-109287 | medium | 4.3 | No | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir... | 2026-10-23 |