CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

[SECURITY] Fedora 43 Update: ImageMagick-7.1.2.27-1.fc43

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

CVE-2026-19006

The CVE affects mf-yang openclaw-cn 2026.2.5, specifically the Ggateway Exec Approval Flow component, with the vulnerability located in src/agents/bash-tools.exec.ts. The manipulation leads to incorrect authorization and can be exploited remotely; exploitation is public. The project was informed ...

EUVD-2026-53730

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-18992

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

EUVD-2026-53706

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/modeltools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The explo...

CVE-2026-18993

The CVE-2026-18993 entry relates to NousResearch hermes-agent, specifically the Memory Toolset component, file hermes-agent/model_tools.py. The description indicates improper access controls in this functionality and an exploitable condition that can be triggered remotely. Affected versions inclu...

CVE-2026-18993 NousResearch hermes-agent Memory Toolset model_tools.py access control

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/modeltools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The explo...

EUVD-2026-53705

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

CVE-2026-18992

The CVE concerns zhayujie CowAgent, specifically the Self-Evolution Review Agent, where the vulnerability affects the function _select_tools in agent/evolution/executor.py. Affects CowAgent up to version 2.1.1. The root cause is a manipulation that leads to incorrect authorization, enabling a rem...

CVE-2026-18992 zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

CVE-2026-18991

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

CVE-2026-18991

Nanacoai NanoClaw

EUVD-2026-53676

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...

EUVD-2026-53685

H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

Important Photon OS Security Update - PHSA-2026-5.0-92-0947

Updates of 'libgcrypt', 'python3-mistune', 'gnuplot', 'tpm2-tools', 'glib-networking' packages of Photon OS have been released...

EulerOS 2.0 SP13 : nfs-utils (EulerOS-SA-2026-2983)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

UBUNTU-CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

CVE-2026-19028 HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

H5Zfilterfletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a sizet underflow. This allows attackers to cause a denial o...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...