HKUDS vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202647

Newest CVEs

• CVE-2026-114108

  HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

  HKUDS · Vibe-Trading

  Critical9.3
• CVE-2026-114107

  HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

  HKUDS · Vibe-Trading

  High8.7
• CVE-2026-114106

  HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

  HKUDS · Vibe-Trading

  High8.7
• CVE-2026-102874

  HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection

  HKUDS · AnyTool

  Medium6.9
• CVE-2026-86062

  LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

  HKUDS · LightRAG

  Medium6.1
• CVE-2026-85740

  LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

  HKUDS · LightRAG

  High7.1
• CVE-2026-85734

  LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

  HKUDS · LightRAG

  Critical9.1
• CVE-2026-85725

  LightRAG: Plaintext Passwords Compared Without Constant-Time Function

  HKUDS · LightRAG

  Medium5.9
• CVE-2026-85709

  LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

  HKUDS · LightRAG

  Medium5.3
• CVE-2026-92576

  HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool

  HKUDS · nanobot

  Critical9.2