Skip to content
Hkuds vulnerabilities
Newest
-
hkuds vibe-trading
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CVE-2026-114108
Fix available
9.3 Critical
-
hkuds vibe-trading
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
CVE-2026-114106
Fix available
8.7 High
-
hkuds vibe-trading
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
CVE-2026-114107
Fix available
8.7 High
-
hkuds anytool
HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
CVE-2026-102874
6.9 Medium
-
hkuds lightrag
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-86062
Fix available
6.1 Medium
-
hkuds lightrag
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85740
Fix available
7.1 High
-
hkuds lightrag
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
Fix available
9.1 Critical
-
hkuds lightrag
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85725
Fix available
5.9 Medium
-
hkuds lightrag
LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
CVE-2026-85709
Fix available
5.3 Medium
-
hkuds nanobot
HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
CVE-2026-92576
9.2 Critical
-
hkuds nanobot
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
CVE-2026-90809
6.9 Medium
-
hkuds nanobot
HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
CVE-2026-90808
5.3 Medium
-
hkuds autoagent
AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
CVE-2026-86124
9.3 Critical
-
hkuds ai-trader
HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
CVE-2026-85030
6.3 Medium
-
hkuds nanobot
HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
CVE-2026-19246
5.3 Medium
-
hkuds nanobot
HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
CVE-2026-19245
4.8 Medium
-
hkuds nanobot
HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
CVE-2026-19244
5.1 Medium
-
hkuds lightrag
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
CVE-2026-61808
9.8 Critical
-
hkuds nanobot
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
CVE-2026-19243
5.3 Medium
-
hkuds lightrag
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
CVE-2026-61740
Fix available
9.3 Critical
-
hkuds lightrag
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
CVE-2026-61736
Fix available
9.3 Critical
-
hkuds vibe-trading
Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type
CVE-2026-58173
6.0 Medium
-
hkuds vibe-trading
Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier
CVE-2026-58171
2.3 Low
-
hkuds vibe-trading
Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
CVE-2026-58170
7.2 High
-
hkuds vibe-trading
Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution
CVE-2026-58169
7.7 High
-
hkuds deeptutor
DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users
CVE-2026-58168
Fix available
7.7 High
-
hkuds openharness
OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
CVE-2026-56696
5.3 Medium
-
hkuds openharness
OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
CVE-2026-56695
7.1 High
-
hkuds nanobot
nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
CVE-2026-48716
8.7 High
-
hkuds ai-trader
HKUDS AI-Trader Research Export agents.csv information disclosure
CVE-2026-12203
6.9 Medium
-
hkuds nanobot
Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
CVE-2026-49140
5.3 Medium
-
hkuds nanobot
Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
CVE-2026-49139
7.0 High
-
hkuds nanobot
Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
CVE-2026-49138
Fix available
5.3 Medium
-
hkuds deepcode
DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
CVE-2026-32847
8.7 High
-
hkuds openharness
HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
CVE-2026-7551
8.7 High
-
hkuds openharness
HKUDS OpenHarness Insecure Default Remote Channel Allowlist
CVE-2026-6823
8.3 High
-
hkuds openharness
HKUDS OpenHarness Plugin Management Command Exposure
CVE-2026-6819
8.7 High
-
hkuds openharness
HKUDS OpenHarness Session Key Collision Privilege Escalation
CVE-2026-6729
5.3 Medium
-
hkuds openharness
OpenHarness SSRF via web_fetch and web_search
CVE-2026-40516
7.8 High
-
hkuds openharness
OpenHarness Permission Bypass via grep and glob root argument
CVE-2026-40515
8.7 High
-
hkuds openharness
OpenHarness Remote Administrative Command Injection via Gateway Handler
CVE-2026-40502
8.7 High
-
hkuds openharness
OpenHarness Path Traversal Information Disclosure via /memory show
CVE-2026-40503
7.1 High
-
hkuds nanobot
nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
CVE-2026-35589
8.0 High
-
hkuds lightrag
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
CVE-2026-39413
Fix available
4.2 Medium
-
hkuds openharness
OpenHarness Improper Access Control via File Tools
CVE-2026-22682
8.4 High
-
hkuds nanobot
Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
CVE-2026-33654
8.9 High
-
hkuds nanobot
Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
CVE-2026-2577
10.0 Critical
-
hkuds lightrag
HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal
CVE-2025-6773
Fix available
4.8 Medium