[ Vendor · 9 CVEs ]
HKUDS
CVEs affecting HKUDS published in the last 30 days, plus any HKUDS CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114106 | 21 Oct 2026 | CVSS 7.5 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files… | |
| CVE-2026-114107 | 21 Oct 2026 | CVSS 8.8 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands… | |
| CVE-2026-114108 | 21 Oct 2026 | CVSS 9.8 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the… | |
| CVE-2026-102874 | 30 Sep 2026 | CVSS 7.3 | HKUDS AnyToolA vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the… | |
| CVE-2026-86062 | 22 Sep 2026 | CVSS 6.1 | lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders… | Fix |
| CVE-2026-85740 | 22 Sep 2026 | CVSS 7.1 | lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py… | Fix |
| CVE-2026-85734 | 22 Sep 2026 | CVSS 9.1 | lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does… | Fix |
| CVE-2026-85725 | 22 Sep 2026 | CVSS 5.9 | lightrag-hku: Plaintext Passwords Compared Without Constant-Time FunctionLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext… | Fix |
| CVE-2026-85709 | 22 Sep 2026 | CVSS 5.3 | lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from… | Fix |