Export limit exceeded: 413548 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413548 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115419 | 1 Aws | 2 Strands-agents, Strands-agents Sdk | 2026-10-22 | 8.1 High |
| The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript). | ||||
| CVE-2026-19111 | 1 Aws | 1 Strands-agents-tools | 2026-08-07 | 8.1 High |
| Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3. | ||||
| CVE-2026-18733 | 1 Aws | 2 Strands-agents-tools, Strands Agents Tools | 2026-08-04 | 8.8 High |
| A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0. | ||||
Page 1 of 1.