HKUDS LightRAG

• CVE-2026-86062 Medium 6.1 LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content 0.3%
• CVE-2026-85740 High 7.1 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard 0.3%
• CVE-2026-85734 Critical 9.1 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks 0.6%
• CVE-2026-85725 Medium 5.9 LightRAG: Plaintext Passwords Compared Without Constant-Time Function 0.4%
• CVE-2026-85709 Medium 5.3 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses 0.4%
• CVE-2026-61808 Critical 9.8 LightRAG: Missing Authentication for Critical API Functions in Default Configuration 2.5%
• CVE-2026-61740 Critical 9.3 LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection 0.5%
• CVE-2026-61736 Critical 9.3 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests 1.4%
• CVE-2026-39413 Medium 4.2 LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API 0.2%
• CVE-2025-6773 Medium 5.3 HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal 0.2%