Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75507 | high | 7.5 | No | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMe... | 2026-10-23 |
| CVE-2026-78119 | medium | 6.3 | No | The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit l... | 2026-10-23 |
| CVE-2026-78118 | high | 7.0 | No | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from seve... | 2026-10-23 |
| CVE-2026-19947 | medium | 5.3 | No | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set().... | 2026-10-23 |
| CVE-2026-115247 | medium | 4.3 | No | A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. T... | 2026-10-23 |
| CVE-2026-114576 | low | 3.7 | No | A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The... | 2026-10-23 |
| CVE-2026-114441 | high | 7.3 | No | A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.ph... | 2026-10-23 |
| CVE-2026-114508 | medium | 6.5 | No | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can t... | 2026-10-23 |
| CVE-2026-114384 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /tra... | 2026-10-23 |
| CVE-2026-114381 | medium | 6.3 | No | A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /ord... | 2026-10-23 |
| CVE-2026-114378 | medium | 6.3 | No | A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. T... | 2026-10-23 |
| CVE-2026-114141 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler... | 2026-10-23 |
| CVE-2026-114375 | medium | 6.3 | No | A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/... | 2026-10-23 |
| CVE-2026-112381 | medium | 5.9 | No | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origi... | 2026-10-23 |
| CVE-2026-111817 | medium | 5.3 | No | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers... | 2026-10-23 |
| CVE-2026-114266 | medium | 6.3 | No | A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query o... | 2026-10-23 |
| CVE-2026-111810 | high | 7.5 | No | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a reque... | 2026-10-23 |
| CVE-2026-111808 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects... | 2026-10-23 |
| CVE-2026-111805 | high | 8.6 | No | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affec... | 2026-10-23 |
| CVE-2026-111804 | high | 8.2 | No | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-suppli... | 2026-10-23 |