Hkuds vulnerabilities
48 CVEs and advisories name Hkuds as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-49140Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
- CVE-2026-49139Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
- CVE-2026-49138Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
- CVE-2026-32847DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
- CVE-2026-7551HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
- CVE-2026-6823HKUDS OpenHarness Insecure Default Remote Channel Allowlist
- CVE-2026-6819HKUDS OpenHarness Plugin Management Command Exposure
- CVE-2026-6729HKUDS OpenHarness Session Key Collision Privilege Escalation
- CVE-2026-40516OpenHarness SSRF via web_fetch and web_search
- CVE-2026-40515OpenHarness Permission Bypass via grep and glob root argument
- CVE-2026-40502OpenHarness Remote Administrative Command Injection via Gateway Handler
- CVE-2026-40503OpenHarness Path Traversal Information Disclosure via /memory show
- CVE-2026-35589nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
- CVE-2026-39413LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
- CVE-2026-22682OpenHarness Improper Access Control via File Tools
- CVE-2026-33654Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- CVE-2026-2577Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
- CVE-2025-6773HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal