Vulnerabilities in HKUDS
48 resultsCVE-2026-61808CRITICALLightRAG: Missing Authentication for Critical API Functions in Default ConfigurationEPSS 2.5%CVE-2026-19243MEDIUMHKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injectionEPSS 2.3%CVE-2026-40502HIGHOpenHarness Remote Administrative Command Injection via Gateway HandlerEPSS 1.7%CVE-2026-61736CRITICALLightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsEPSS 1.4%CVE-2026-102874MEDIUMHKUDS AnyTool Execute Endpoint main.py subprocess.run os command injectionEPSS 1.3%CVE-2026-86124CRITICALAutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command ServerEPSS 1.0%CVE-2026-2577CRITICALNanobot Unauthenticated WhatsApp Session Hijack via WebSocket BridgeEPSS 0.7%CVE-2026-7551HIGHHKUDS OpenHarness Remote Command Execution via /bridge Slash CommandEPSS 0.6%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-114107HIGHHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolEPSS 0.6%CVE-2026-90809MEDIUMHKUDS nanobot ExecTool shell.py ExecTool._spawn argument injectionEPSS 0.6%CVE-2026-58170HIGHVibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading MandatesEPSS 0.6%CVE-2026-114108CRITICALHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEEPSS 0.5%CVE-2026-61740CRITICALLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionEPSS 0.5%CVE-2026-33654HIGHZero-Click Indirect Prompt Injection and Authentication Bypass via Email PollingEPSS 0.5%CVE-2026-19244MEDIUMHKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access controlEPSS 0.5%CVE-2026-85030MEDIUMHKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic errorEPSS 0.5%CVE-2026-58173MEDIUMVibe-Trading < 0.1.10 - Path Traversal via Persistent Memory TypeEPSS 0.4%CVE-2026-85725MEDIUMLightRAG: Plaintext Passwords Compared Without Constant-Time FunctionEPSS 0.4%CVE-2026-92576CRITICALHKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchToolEPSS 0.4%