https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T16:06:37.246952+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-374954 EUVD-2026-374954 2026-10-09T16:06:37.249085+00:00 EUVD-2026-374954 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82273 fkie_cve-2026-82273 2026-10-09T16:06:37.249118+00:00

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.

 https://cve.radiocsirt.org/vuln/ghsa-q48c-g8g8-2xq8 GHSA-q48c-g8g8-2xq8 2026-10-09T16:06:37.249149+00:00

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.