Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115247 | medium | 4.3 | No | A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. T... | 2026-10-23 |
| CVE-2026-114576 | low | 3.7 | No | A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The... | 2026-10-23 |
| CVE-2026-114441 | high | 7.3 | No | A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.ph... | 2026-10-23 |
| CVE-2026-114508 | medium | 6.5 | No | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can t... | 2026-10-23 |
| CVE-2026-114384 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /tra... | 2026-10-23 |
| CVE-2026-114381 | medium | 6.3 | No | A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /ord... | 2026-10-23 |
| CVE-2026-114378 | medium | 6.3 | No | A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. T... | 2026-10-23 |
| CVE-2026-114141 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler... | 2026-10-23 |
| CVE-2026-114375 | medium | 6.3 | No | A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/... | 2026-10-23 |
| CVE-2026-112381 | medium | 5.9 | No | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origi... | 2026-10-23 |
| CVE-2026-111817 | medium | 5.3 | No | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers... | 2026-10-23 |
| CVE-2026-114266 | medium | 6.3 | No | A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query o... | 2026-10-23 |
| CVE-2026-111810 | high | 7.5 | No | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a reque... | 2026-10-23 |
| CVE-2026-111808 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects... | 2026-10-23 |
| CVE-2026-111805 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affec... | 2026-10-23 |
| CVE-2026-111804 | high | 8.2 | No | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-suppli... | 2026-10-23 |
| CVE-2026-109299 | medium | 6.5 | No | Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission t... | 2026-10-23 |
| CVE-2026-109298 | medium | 6.5 | No | Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that exp... | 2026-10-23 |
| CVE-2026-109297 | medium | 6.5 | No | Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily freq... | 2026-10-23 |
| CVE-2026-109296 | medium | 4.3 | No | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider bac... | 2026-10-23 |