CVE-2026-82271

R2R (SciPhi-AI) versions through 3.6.5 fail to properly validate user ownership in conversation update and message handlers. An authenticated user can supply arbitrary conversation identifiers to rename other users' conversations and append messages to their histories, corrupting state and inject...

EUVD-2026-67802

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

CVE-2026-82271 R2R Missing Ownership Check Allows Modifying Other Users' Conversations

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

CVE-2025-60360

CVE-2025-60360 affects radare2 up to v5.9.8, where a memory leak in r2r_subprocess_init is reported. Multiple connected advisories (Ubuntu USN-7915-1, OSV, RH) describe the issue as memory leaks that could enable denial of service, with CVSSv3.1 metrics indicating a local attack vector, low attac...