Hkuds Lightrag vulnerabilities

• hkuds lightrag LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content CVE-2026-86062 Fix available 6.1 MediumSeptember 22, 2026
• hkuds lightrag LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard CVE-2026-85740 Fix available 7.1 HighSeptember 22, 2026
• hkuds lightrag LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks CVE-2026-85734 Fix available 9.1 CriticalSeptember 22, 2026
• hkuds lightrag LightRAG: Plaintext Passwords Compared Without Constant-Time Function CVE-2026-85725 Fix available 5.9 MediumSeptember 22, 2026
• hkuds lightrag LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses CVE-2026-85709 Fix available 5.3 MediumSeptember 22, 2026
• hkuds lightrag LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVE-2026-61808 9.8 CriticalAugust 7, 2026
• hkuds lightrag LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection CVE-2026-61740 Fix available 9.3 CriticalJuly 15, 2026
• hkuds lightrag LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests CVE-2026-61736 Fix available 9.3 CriticalJuly 15, 2026
• hkuds lightrag LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API CVE-2026-39413 Fix available 4.2 MediumApril 8, 2026
• hkuds lightrag HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal CVE-2025-6773 Fix available 4.8 MediumJune 27, 2025