CVE-2026-19111

CVE-2026-19111 affects Amazon Strands Agents Tools’ memory tools (mongodb_memory, elasticsearch_memory, mem0_memory) prior to 0.8.3. The issue is an insecure direct object reference that could allow remote authenticated users to access, modify, or delete memories belonging to other tenants by pro...

EUVD-2026-54214

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

GHSA-62FC-8686-HFMQ Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

Summary There is a medium severity vulnerability in Traefik's Kubernetes CRD provider. When providers.kubernetesCRD.allowCrossNamespace is disabled — the default — cross-namespace @kubernetescrd references are rejected for middlewares, TLS options and HTTP/TCP ServersTransports, but the same...

EUVD-2026-54293

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a...

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-65523

CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions

CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-28180 WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

MINI-Q553-CC97-V6JX

Bulletin has no description...

MINI-MV89-W3JJ-XCW2

Bulletin has no description...

MINI-44MF-V23G-47M9

Bulletin has no description...

Malicious code in @atom8n/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...

CVE-2026-18597

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...

UBUNTU-CVE-2026-64584

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...

CVE-2023-7353

Erroneously reserved under wrong year by automation defect; never assigned...

EUVD-2026-53771

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: cancel pending IN work before freeing the midi object The fmidi driver embeds a work item midi-work whose handler, fmidiinwork, dereferences the enclosing struct fmidi through containerof. This work is armed...