Hkuds vulnerabilities
48 CVEs and advisories name Hkuds as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114108HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
- CVE-2026-114107HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
- CVE-2026-114106HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
- CVE-2026-102874HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
- CVE-2026-86062LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
- CVE-2026-85740LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
- CVE-2026-85734LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
- CVE-2026-85725LightRAG: Plaintext Passwords Compared Without Constant-Time Function
- CVE-2026-85709LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
- CVE-2026-92576HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
- CVE-2026-90809HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
- CVE-2026-90808HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
- CVE-2026-86124AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
- CVE-2026-85030HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
- CVE-2026-19246HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
- CVE-2026-19245HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
- CVE-2026-19244HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control
- CVE-2026-61808LightRAG: Missing Authentication for Critical API Functions in Default Configuration
- CVE-2026-19243HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
- CVE-2026-61740LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
- CVE-2026-61736LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
- CVE-2026-58173Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type
- CVE-2026-58171Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier
- CVE-2026-58170Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
- CVE-2026-58169Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution
- CVE-2026-58168DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users
- CVE-2026-56696OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
- CVE-2026-56695OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
- CVE-2026-48716nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
- CVE-2026-12203HKUDS AI-Trader Research Export agents.csv information disclosure