Reported issues

Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.

IssueSeverityListed versionReported
CVE-2026-49986The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a tru… high Not checked Aug 14, 2026

Versions in the registry

4.23.5 (listed), 4.23.4, 4.23.3, 4.23.2, 4.23.1, 4.23.0, 4.22.0, 4.21.0, 4.19.1, 4.19.0, 4.18.0, 4.17.1, 4.16.0, 4.14.3