13 matches found
CVE-2026-82283
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...
EUVD-2026-67814
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...
CVE-2026-82283
VoltAgent through 2.1.20 contains an authorization flaw in its memory API handlers , which fail to validate conversation ownership . An authenticated attacker can supply caller-controlled identifiers to memory endpoints to read, modify, or delete conversations and messages belonging to other user...
CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...
CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...
EUVD-2026-40008
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...
@bishk029/agent-smith (>=0.1.0, <=2.0.1), ai-ad-generator (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-13511 via @voltagent/server-hono (>=1.2.11, <=2.0.14)
@voltagent/server-hono NPM version =1.2.11, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERHONO-17875092...
@bishk029/agent-smith (>=0.1.0, <=2.0.1) potentially affected by CVE-2026-13511 via @voltagent/serverless-hono (2.0.12)
@voltagent/serverless-hono NPM version 2.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on @voltagent/serverless-hono and may be impacted: - @bishk029/agent-smith =0.1.0, =2.0.1 Source cves: CVE-2026-13511 Source advisory:...
@bishk029/agent-smith (>=0.1.0, <=2.0.1), @voltagent/server-elysia (>=2.0.0, <=3.0.0-next.0) +3 more potentially affected by CVE-2026-13511 via @voltagent/server-core (>=1.0.0-next.1, <=3.0.0-next.0)
@voltagent/server-core NPM version =1.0.0-next.1, =0.1.0, =2.0.0, =1.0.0-next.1, =1.0.1, =0.1.0, =0.1.1 Source cves: CVE-2026-13511 Source advisory: SNYK:JS-VOLTAGENTSERVERCORE-17875090...
CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...
CVE-2026-13511
CVE-2026-13511 affects VoltAgent up to 2.1.17, specifically the Memory REST API’s memory.handlers.ts function handleGetMemoryConversation. The issue arises from manipulating the argument conversationId, leading to improper authorization. Exploitation is described as possible from remote, with hig...
CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...
PT-2026-53167
Name of the Vulnerable Software and Affected Versions VoltAgent versions prior to 2.1.18 Description An improper authorization issue exists within the Memory REST API component, specifically in the handleGetMemoryConversation function located in the...