EUVD-2026-42106

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...

CVE-2026-59706

CVE-2026-59706 (mem0) is a vulnerability where unauthenticated config API endpoints expose LLM API keys in plaintext and enable server-side request forgery. The issue arises from an attacker-controllable ollama_base_url parameter, allowing SSRF to internal addresses (e.g., cloud IMDS) via PUT /ap...

CVE-2026-59706 mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...

CVE-2026-45001 OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access

OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, a...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

Frigate Cross-Site Request Forgery Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site request forgery vulnerability exists in Frigate versions prior to 0.13.0 Beta 3, which stems from a cross-site request forgery CSRF vulnerability in t...

PT-2023-29639 · Frigate · Frigate

Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. The config/save and config/set endpoints of Frigate do not implement any CSRF protection, making it possible for a request sourced from...

PT-2023-32979 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.7 Description: The issue allows attackers to arbitrarily disable 2FA through "config/otp/app/disable" and "config/otp/email/disable" API endpoints. Recommendations: For versions prior to 2.6.7, upgrade your...

PT-2021-23081 · Grafana · Grafana Agent

Name of the Vulnerable Software and Affected Versions: Grafana Agent versions prior to 0.20.1 and 0.21.2 Description: The issue concerns the exposure of inline secrets in plaintext over two endpoints: /-/config for metrics instance configs defined in the base YAML file and...