Login Request a demo
LI
Product
LightRAG
by HKUDS · last CVE Sep 22, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 4High 1Medium 5Low 0
Severity
All severities10Critical4High1Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add LightRAG to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-61808
9.8
2%
Aug 7
LightRAG: Missing Authentication for Critical API Functions in Default Configuration
Affected: < 1.5.5rc1
CVE-2026-61740
9.3
1%
Jul 15
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Affected: < 1.5.4
CVE-2026-61736
9.3
1%
Jul 15
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Affected: < 1.5.4
CVE-2026-85734
9.1
1%
Sep 22
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Affected: < 1.5.5
Showing 4