HKUDS Vibe-Trading

• CVE-2026-114108 Critical 9.8 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE 0.5%
• CVE-2026-114107 High 8.8 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool 0.6%
• CVE-2026-114106 High 7.5 HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path 0.4%
• CVE-2026-58173 Medium 6.5 Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type 0.4%
• CVE-2026-58171 Medium 4.2 Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier 0.3%
• CVE-2026-58170 High 8.3 Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates 0.6%
• CVE-2026-58169 High 7.5 Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution 0.4%