CVE-2026-111813

Published 21 October 2026 · tracked since 22 October 2026

Description

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. U

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-114724 HIGH 7.4
• CVE-2026-114715 MEDIUM 6.8
• CVE-2026-114658 HIGH 8.8
• CVE-2026-114636 HIGH 8.7
• CVE-2026-114638 HIGH 8.7
• CVE-2026-114640 HIGH 8.7
• CVE-2026-114577 HIGH 7.3
• CVE-2026-12664 MEDIUM 6.8
• CVE-2026-15723 HIGH 8.2
• CVE-2026-110264 CRITICAL 10

→ Open the live CVE board · all tools