The strands-agents FileSessionManager stores session data in a world-writable directory (/tmp/strands/sessions/) using predictable file paths and writes that follow symbolic links. This allows a local attacker to create symlinks to arbitrary files, causing the application to overwrite those files with attacker-controlled session data. This can lead to local privilege escalation by overwriting shell configuration files, SSH keys, cron jobs, or systemd user services. Additionally, the lack of integrity verification on session files enables persistent prompt injection attacks by tampering with session data.
The strands-agents package has a local confidentiality vulnerability in its default FileSessionManager storage. By default, session data is stored under /tmp/strands/sessions with directory and file permissions that allow other local users on shared systems to read sensitive session data. This can expose prompts, model outputs, tool inputs/outputs, intermediate states, and secrets stored in session files. The issue arises because the storage directories and files are created with permissions relying on the process umask, commonly 022, resulting in directories with 0755 and files with 0644 permissions. A fix is available in version 1.48.0 that addresses these permission issues.
A heap buffer overflow vulnerability exists in the Snappy.uncompress*Array typed-array methods of snappy-java before version 1.1.10.9. The issue arises because the methods size the result array by dividing the declared uncompressed byte length by the element size, but native code writes the full byte length, potentially writing up to 7 bytes past the end of the Java array if the length is not a multiple of the element size. This heap corruption can lead to application instability or crashes. The vulnerability is fixed in version 1.1.10.9, where the methods now reject uncompressed lengths that are not multiples of the element size by throwing a SnappyIOException. Users can mitigate by verifying the uncompressed length is a multiple of the element size before calling these methods.
A vulnerability in snappy-java prior to version 1.1.10.9 allows JVM crashes due to unchecked array range parameters in Snappy.arrayCopy and related stream read/write methods. The flaw arises from native memcpy calls without validating offsets and lengths, leading to out-of-bounds memory access and JVM crashes. This issue has been fixed in version 1.1.10.9 by adding proper range checks.
Several decompression functions in snappy-java versions prior to 1.1.10.9 allocate memory based on the uncompressed length declared in the compressed data without proper validation. This can lead to excessive memory allocation up to 2 GB or trigger exceptions, causing denial of service. The issue affects multiple entry points including Snappy.uncompress methods and input streams. The vulnerability is fixed in version 1.1.10.9 by validating and limiting the declared uncompressed length relative to the compressed input size.
A vulnerability in Grav versions from 1.7.53.3 up to but not including 1.7.53.6 allows unauthorized users to bypass authorization checks in the Debugger::isDebuggerRequestAuthorized() function. This flaw enables unauthenticated visitors to access /__clockwork/ profiler data by exploiting a fallback to loopback REMOTE_ADDR. When Grav is behind a same-host reverse proxy, remote requests can be treated as loopback, allowing attackers to read sensitive stored records such as administrator plaintext passwords and configuration credentials.
A race condition vulnerability exists in a2aproject a2a-java up to version 1.2.0.Final in the TaskManager.saveTaskEvent function. This vulnerability can be exploited remotely and may lead to integrity and availability impacts. Upgrading to version 1.3.0.Final resolves the issue.
A resource consumption weakness exists in a2aproject a2a-java up to version 1.2.0.Final in the Push Notification Config Store component. The vulnerability affects the InMemoryPushNotificationConfigStore.setInfo function and can be exploited remotely to cause resource exhaustion. Upgrading to version 1.3.0.Final mitigates the issue.
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7, and multiple LTS releases including 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10, contain a process control vulnerability. This flaw could allow a high privileged attacker with remote access to bypass protection mechanisms. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity.
A resource consumption vulnerability exists in the a2aproject a2a-java component ChildQueue's queue.offer function up to version 1.2.0.Final. This flaw can be exploited remotely and leads to denial of service conditions by exhausting resources. Upgrading to version 1.3.0.Final resolves the issue.
KGS Software tia Viewer has a stored cross-site scripting (XSS) vulnerability in its annotation API. An authenticated attacker can inject malicious JavaScript into stickynote annotations, which executes when any user opens the affected document. This vulnerability can lead to session compromise. The issue is fixed in version 1.2.8.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a highly privileged local attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but affects integrity and availability.
PowerProtect Data Domain versions 7.7.1.0 through 8.7, including certain LTS2024, LTS2025, and LTS2026 releases, contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9, indicating medium severity.
A vulnerability in Octopus Server allows a user with permission to upload a malicious NuGet package to deploy a script step that executes outside of the intended parent directory. This could lead to unintended script execution paths. The issue affects unspecified versions of Octopus Server and has a medium severity rating with a CVSS score of 5.1.
CVE-2026-118026 is a vulnerability involving an invalid pointer in the JavaScript garbage collection (GC) component of Firefox. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is classified with high impact according to the Mozilla advisory.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Relative Path Traversal vulnerability. This flaw could allow a high privileged attacker with remote access to tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7, and several LTS releases, contain a path traversal vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-31 and has a CVSS v3.1 score of 7.2, indicating high severity.
CVE-2026-118027 is a frame poisoning vulnerability in the Layout component of Firefox ESR. This security flaw was addressed and fixed in Firefox ESR version 115.44. The vulnerability is considered high impact by the vendor. No public exploit or active exploitation in the wild has been reported. Users of affected versions should upgrade to the fixed release to mitigate the risk.