CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 4:00 PM ET)

What this means for you

This week: 3,218 CVEs published, 240 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,218; Show in the list
Critical, last 7 days: 240; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,760; Show in the list

Showing CVEs that name the product redhat:directory_server_e4s. Show all products

12 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-19843	High 8.4	389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor Assigned by redhat	Sep 7, 2026
CVE-2026-18922	Critical 9.8	389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property Assigned by redhat	Sep 7, 2026
CVE-2026-18453	High 7.5	389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search Assigned by redhat	Sep 7, 2026
CVE-2026-18355	High 7.5	389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() Assigned by redhat	Sep 7, 2026
CVE-2026-76560	High 7.5	389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn Assigned by redhat	Sep 7, 2026
CVE-2026-11770	High 7.5	389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check Assigned by redhat	Jul 31, 2026
CVE-2026-15722	High 7.5	389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing Assigned by redhat	Jul 31, 2026
CVE-2026-11610	High 8.8	389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind Assigned by redhat	Jul 7, 2026
CVE-2026-11774	High 7.6	389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow Assigned by redhat	Jun 11, 2026
CVE-2026-11788	Medium 5.9	389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser Assigned by redhat	Jun 9, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.