CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 9:30 AM ET)

What this means for you

This week: 3,212 CVEs published, 243 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,212; Show in the list
Critical, last 7 days: 243; Show in the list
Healthcare-tagged, last 7 days: 8; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product redhat:directory_server. Show all products

39 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-86345	Critical 9.0	389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result Assigned by redhat	Oct 1, 2026
CVE-2026-86344	High 7.5	389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue Assigned by redhat	Oct 1, 2026
CVE-2026-19843	High 8.4	389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor Assigned by redhat	Sep 7, 2026
CVE-2026-18922	Critical 9.8	389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property Assigned by redhat	Sep 7, 2026
CVE-2026-18453	High 7.5	389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search Assigned by redhat	Sep 7, 2026
CVE-2026-18355	High 7.5	389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() Assigned by redhat	Sep 7, 2026
CVE-2026-76560	High 7.5	389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn Assigned by redhat	Sep 7, 2026
CVE-2026-78701	Medium 6.5	389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos Assigned by redhat	Aug 25, 2026
CVE-2026-18663	Medium 5.9	389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control Assigned by redhat	Aug 12, 2026
CVE-2026-19404	Medium 6.5	389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance Assigned by redhat	Aug 10, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.