CVE-2026-11838

MediumCVSS 4.3/10Last modified Sep 9, 2026

Description

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation.

This issue affects Library Reservation System: before v22.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.Library Reservation System< v22.2

References

Timeline

Published
Sep 9, 2026
Last modified
Sep 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-11838310.0A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The cCVE-2026-1183846.1GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.CVE-2026-1183866.5Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were dCVE-2026-118399.9Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell tCVE-2026-1183918.9Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust CVE-2026-1183944.3The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing theCVE-2026-1183957.5Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/CVE-2026-11847.5GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 tCVE-2026-118408.8Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticateCVE-2026-1184033.7The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, alloCVE-2026-1184045.3The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping caCVE-2026-1184054.3Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users
CVE-2026-11838: Medium severity, CVSS 4.3 | Vulnix