Login Request a demo
LI
Product
LightRAG
by HKUDS · last CVE Sep 22, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 4High 1Medium 5Low 0
Severity
All severities10Critical4High1Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add LightRAG to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-61808
9.8
2%
Aug 7
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
Affected: < 1.5.5rc1
CVE-2026-61740
9.3
1%
Jul 15
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Affected: < 1.5.4
CVE-2026-61736
9.3
1%
Jul 15
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Affected: < 1.5.4
CVE-2026-85734
9.1
1%
Sep 22
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Affected: < 1.5.5
CVE-2026-85740
7.1
0%
Sep 22
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Affected: < 1.5.5
CVE-2026-39413
6.5
0%
Apr 8
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
Affected: < 1.4.14
CVE-2026-86062
6.1
0%
Sep 22
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
Affected: < 1.5.5
CVE-2026-85725
5.9
0%
Sep 22
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
Affected: < 1.5.5
CVE-2026-85709
5.3
0%
Sep 22
LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
Affected: < 1.5.5
CVE-2025-6773
5.3
0%
Jun 27
HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal
Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +3 more
Showing 10