@bishk029/agent-smith (>=0.1.0, <=2.0.1), ai-ad-generator (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-13511 via @voltagent/server-hono (>=1.2.11, <=2.0.14)

@voltagent/server-hono NPM version =1.2.11, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERHONO-17875092...

@bishk029/agent-smith (>=0.1.0, <=2.0.1) potentially affected by CVE-2026-13511 via @voltagent/serverless-hono (2.0.12)

@voltagent/serverless-hono NPM version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on @voltagent/serverless-hono and may be impacted: - @bishk029/agent-smith =0.1.0, =2.0.1 Source cves: CVE-2026-13511 Source advisory:...

@bishk029/agent-smith (>=0.1.0, <=2.0.1), @voltagent/server-elysia (>=2.0.0, <=3.0.0-next.0) +3 more potentially affected by CVE-2026-13511 via @voltagent/server-core (>=1.0.0-next.1, <=3.0.0-next.0)

@voltagent/server-core NPM version =1.0.0-next.1, =0.1.0, =2.0.0, =1.0.0-next.1, =1.0.1, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERCORE-17875090...

CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...