CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 27, 2026, 1:40 AM ET)

What this means for you

This week: 4,358 CVEs published, 325 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 4,358; Show in the list
Critical, last 7 days: 325; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,758; Show in the list

Showing CVEs that name the product apache_software_foundation:apache_traffic_server. Show all products

57 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-112381	Medium 5.9	Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response Assigned by apache	Oct 21, 2026
CVE-2026-111817	Medium 5.3	Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout Assigned by apache	Oct 21, 2026
CVE-2026-111812	Critical 10.0	Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials Assigned by apache	Oct 21, 2026
CVE-2026-111811	Critical 9.0	Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication Assigned by apache	Oct 21, 2026
CVE-2026-111809	Critical 9.3	Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling Assigned by apache	Oct 21, 2026
CVE-2026-111810	High 7.5	Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service Assigned by apache	Oct 21, 2026
CVE-2026-111815	Critical 10.0	Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement Assigned by apache	Oct 21, 2026
CVE-2026-111814	Critical 10.0	Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin Assigned by apache	Oct 21, 2026
CVE-2026-111808	High 8.6	Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion Assigned by apache	Oct 21, 2026
CVE-2026-111805	High 8.6	Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion Assigned by apache	Oct 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.