{"vulnerability": "cve-2026-8643", "sightings": [{"uuid": "84bc764b-9993-4843-961d-3b0d2dd8b1da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8643", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mnajmu6f7v2e", "content": "[oss-security][CVE-2026-8643] pip can extract console_scripts and gui_scripts outside installation directory", "creation_timestamp": "2026-06-01T16:43:42.245938Z"}, {"uuid": "c8ed346c-e859-4475-b166-84e5d42140a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8643", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mppabnrruz2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-8643 \u0432 pip: \u043a\u0430\u043a \u043e\u043d\u0430 \u0432\u043b\u0438\u044f\u0435\u0442 \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c Python-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/12585E3E-BDB1-4E88-8618-3C10DECA2D2C", "creation_timestamp": "2026-07-02T23:56:41.780584Z"}, {"uuid": "c943b0fd-2739-4b82-adb0-4cb0fb5249bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8643", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mq7lkblaow2f", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-8643 impacts pip in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/595\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-07-09T12:00:58.285619Z"}, {"uuid": "0cbccaac-4f1b-46b6-9a82-04b2247daef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86435", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muwog53f462k", "content": "\ud83d\udfe0 CVE-2026-86435 - High (7.5)\n\ncommonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Foot...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86435/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-07T14:04:21.740667Z"}, {"uuid": "628df03f-7526-4dd4-8093-e7f001f71e02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/adymq3lw4sihz", "content": "CVE-2026-86430 - league/commonmark before 2.9.1 Denial of Service via parsing\nCVE ID : CVE-2026-86430\n \n Published : Sept. 7, 2026, 1:20 p.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in...", "creation_timestamp": "2026-09-07T15:00:38.002259Z"}, {"uuid": "a0b5c123-3e72-4e98-af93-98507c159bc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86438", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ftbhu4ftxxpfg", "content": "CVE-2026-86438 - Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action\nCVE ID : CVE-2026-86438\n \n Published : Sept. 7, 2026, 10:17 p.m. | 37\u00a0minutes ago\n \n Description : Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowse...", "creation_timestamp": "2026-09-07T23:00:40.367244Z"}, {"uuid": "c7ae7fd4-608c-48dd-a125-4284ade25b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86437", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7j7akxumrsw6e", "content": "CVE-2026-86437 - Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload\nCVE ID : CVE-2026-86437\n \n Published : Sept. 7, 2026, 10:17 p.m. | 37\u00a0minutes ago\n \n Description : Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/...", "creation_timestamp": "2026-09-07T23:06:40.277642Z"}, {"uuid": "99f2a0ff-c43c-4a42-94f7-f021240c6667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86439", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpx2ca5423", "content": "\ud83d\udfe0 CVE-2026-86439 - High (8.8)\n\nknowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86439/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-08T00:04:22.766659Z"}, {"uuid": "4dd7f327-1676-4f61-9b95-9690a268762d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86439", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muz3c5rmgl24", "content": "CVE-2026-86439 - knowns\nVersions of knowns older than 0.30.0 do not verify the file locations entered into its MCP functions. An attacker could give specially crafted paths to read, create, change, or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#knowns #knownsdev #CVE #infosec", "creation_timestamp": "2026-09-08T13:00:06.664824Z"}, {"uuid": "4a459b84-7030-439f-ae79-f8e00fccc382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86430", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvdtdqrfdp24", "content": "\ud83d\udccc CVE-2026-86430 - league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup... https://www.cyberhub.blog/cves/CVE-2026-86430", "creation_timestamp": "2026-09-12T19:37:06.523396Z"}, {"uuid": "88065ab0-5a6b-492b-97ac-dc18011cadbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86439", "type": "seen", "source": "https://gist.github.com/alon710/723cd5cd84efce7d1b7fc9c58a25b858", "content": "# CVE-2026-86439: CVE-2026-86439: Path Traversal Vulnerability in knowns MCP Document and Memory Storage\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86439\n\n## Summary\nA critical path traversal vulnerability (CWE-22) exists in knowns prior to version 0.30.0. The software fails to restrict file path arguments passed to Model Context Protocol (MCP) tools, permitting low-privilege users to escape the designated base storage directories and manipulate arbitrary markdown files on the host filesystem.\n\n## TL;DR\nUnsafe path resolution in knowns < 0.30.0 allows remote users with low privileges to read, write, and delete arbitrary markdown files on the server.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.8\n- **EPSS Score**: 0.01079 (1.08%)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- knowns prior to version 0.30.0\n- **knowns**: < 0.30.0 (Fixed in: `0.30.0`)\n\n## Mitigation\n\n- Upgrade to version 0.30.0 or higher immediately.\n- Run the knowns service under a highly restricted system user account.\n- Apply network-level restriction controls to block unauthorized MCP endpoint queries.\n\n**Remediation Steps:**\n1. Identify active installations of the knowns service running versions prior to 0.30.0.\n2. Pull the patched version 0.30.0 from official distribution repositories.\n3. Review filesystem configurations to restrict read/write access of the knowns process to the local directory only.\n4. Deploy network firewalls or load balancers to restrict access to the MCP server.\n\n## References\n\n- [GitHub Security Advisory GHSA-9gfj-28hw-jchp](https://github.com/knowns-dev/knowns/security/advisories/GHSA-9gfj-28hw-jchp)\n- [Fix Patch Commit](https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e)\n- [Vulnerable Source Code - Doc Store](https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/doc_store.go#L124-L129)\n- [Vulnerable Source Code - Memory Store](https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/memory_store.go#L203-L211)\n- [Official v0.30.0 Release Notes](https://github.com/knowns-dev/knowns/releases/tag/v0.30.0)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-mcp-doc-and-memory-tools)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86439) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T20:30:32.000000Z"}]}