HHKUDS

Products

Exploited and recent CVEs

• CVE-2026-114108 Critical 9.8 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE 0.5%
• CVE-2026-114107 High 8.8 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool 0.6%
• CVE-2026-114106 High 7.5 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path 0.4%
• CVE-2026-102874 High 7.3 HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection 1.3%
• CVE-2026-86062 Medium 6.1 LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content 0.3%
• CVE-2026-85740 High 7.1 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard 0.3%
• CVE-2026-85734 Critical 9.1 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks 0.6%
• CVE-2026-85725 Medium 5.9 LightRAG: Plaintext Passwords Compared Without Constant-Time Function 0.4%
• CVE-2026-85709 Medium 5.3 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses 0.4%
• CVE-2026-92576 High 8.6 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool 0.4%
• CVE-2026-90809 High 7.3 HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection 0.6%
• CVE-2026-90808 Medium 6.3 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist 0.4%
• CVE-2026-86124 Critical 9.8 AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server 1.0%
• CVE-2026-85030 Low 3.7 HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error 0.5%
• CVE-2026-19246 Medium 6.3 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery 0.4%
• CVE-2026-19245 Low 3.3 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure 0.2%
• CVE-2026-19244 Medium 4.7 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control 0.5%
• CVE-2026-61808 Critical 9.8 LightRAG: Missing Authentication for Critical API Functions in Default Configuration 2.5%
• CVE-2026-19243 Medium 6.3 HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection 2.3%
• CVE-2026-61740 Critical 9.3 LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection 0.5%
• CVE-2026-61736 Critical 9.3 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests 1.4%
• CVE-2026-58173 Medium 6.5 Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type 0.4%
• CVE-2026-58171 Medium 4.2 Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier 0.3%
• CVE-2026-58170 High 8.3 Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates 0.6%
• CVE-2026-58169 High 7.5 Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution 0.4%
• CVE-2026-58168 High 8.8 DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users 0.4%
• CVE-2026-56696 Medium 5.4 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands 0.4%
• CVE-2026-56695 Medium 6.5 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands 0.4%
• CVE-2026-48716 High 8.7 nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write 0.3%
• CVE-2026-12203 Medium 5.3 HKUDS AI-Trader Research Export agents.csv information disclosure 0.4%