Approved changes feed: RSS · Atom
cpe:2.3:a:mem0:mem0:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mem0 (709f8a94-43fc-5cea-b2fb-ce34225ee868) |
|---|---|
| Product | Mem0 (aa069895-12de-5cc2-ad05-bfbd38027d36) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/mem0ai/mem0 |
purl2cpe | 2026-07-28 16:41:05.054277 |
pkg:github/pypi/mem0ai |
purl2cpe | 2026-06-01 10:14:50.726368 |
pkg:npm/mem0ai |
purl2cpe | 2026-07-28 16:41:05.054280 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59706 |
vulnerable | 2026-07-29 01:03:17.537966 |
mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url
CRITICAL (9.3)
mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm endpoint.
Published: 2026-07-07T21:02:22.766Z
Updated: 2026-09-24T14:18:01.365Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59705 |
vulnerable | 2026-07-29 01:03:17.537772 |
mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
CRITICAL (9.8)
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.
Published: 2026-07-07T22:11:25.795Z
Updated: 2026-09-24T14:18:00.388Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.