RHEL 10 : 389-ds-base (RHSA-2026:64769)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:64769 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server...

RHEL 8 : 389-ds:1.4 (RHSA-2026:64776)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64776 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

ALSA-2026:64785 Critical: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length...

PT-2026-87013

Name of the Vulnerable Software and Affected Versions SIMOVE Fleetmanager versions prior to 3.1.13 SIMOVE Fleetmanager versions prior to 3.2.4 SIMOVE Fleetmanager versions prior to 3.3.2 SIMOVE Fleetmanager versions prior to 4.0.1 SIPLANT version 1.7 SIPLANT version 2.2 SIPLANT version 3.0 SIPLAN...

ROS-20260908-73-0021

The vulnerability in python-pip is related to an incorrect restriction on the path name of the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

RHEL 8 : 389-ds:1.4 (RHSA-2026:64790)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64790 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

RHEL 8 : python3 (RHSA-2026:64806)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64806 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

PT-2026-87399

Name of the Vulnerable Software and Affected Versions Active Directory Domain Services affected versions not specified Description A heap-based buffer overflow occurs in Active Directory Domain Services, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overfl...

RHEL 9 : redhat-ds:12 (RHSA-2026:65375)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:65375 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol LDAP...

CVE-2026-86541

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439

Knowns versions before 0.30.0 contain a path traversal vulnerability in MCP tool arguments (specifically the doc_store and memory_store components). Filesystem paths supplied by users are not validated, allowing an attacker with low privileges to read, create, overwrite, or delete Markdown files ...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

AZL-99983 CVE-2026-18922 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

DEBIAN-CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18453

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of opsharedsearch allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USEONEBACKEND control, resulting in denial of servic...

CVE-2026-18922

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes...

CVE-2026-6377

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 before 8.0.3...