Login Request a demo
HK
Vendor
HKUDS
9 products with CVEs on record
42
CVEs
0
On KEV
4
New 30D
Products
VI
Vibe-Trading
HKUDS
9.8
7 CVEs0 on KEV3 new
AN
AnyTool
HKUDS
7.3
1 CVEs0 on KEV1 new
OP
OpenHarness
HKUDS
8.8
11 CVEs0 on KEV0 new
LI
LightRAG
HKUDS
9.8
10 CVEs0 on KEV0 new
NA
nanobot
HKUDS
10.0
8 CVEs0 on KEV0 new
AI
AI-Trader
HKUDS
5.3
2 CVEs0 on KEV0 new
AU
AutoAgent
HKUDS
9.8
1 CVEs0 on KEV0 new
DE
DeepCode
HKUDS
7.5
1 CVEs0 on KEV0 new
DE
DeepTutor
HKUDS
8.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-114108
VI
Vibe-Trading
HKUDS
9.8
0%
Oct 21HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CVE-2026-114107
VI
Vibe-Trading
HKUDS
8.8
1%
Oct 21HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
CVE-2026-114106
VI
Vibe-Trading
HKUDS
7.5
0%
Oct 21HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
CVE-2026-102874
AN
AnyTool
HKUDS
7.3
1%
Sep 30HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
CVE-2026-86062
LI
LightRAG
HKUDS
6.1
0%
Sep 22LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-85740
LI
LightRAG
HKUDS
7.1
0%
Sep 22LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85734
LI
LightRAG
HKUDS
9.1
1%
Sep 22LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85725
LI
LightRAG
HKUDS
5.9
0%
Sep 22LightRAG: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-85709
LI
LightRAG
HKUDS
5.3
0%
Sep 22LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
CVE-2026-92576
NA
nanobot
HKUDS
8.6
0%
Sep 16HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
CVE-2026-86124
AU
AutoAgent
HKUDS
9.8
1%
Sep 5AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
CVE-2026-85030
AI
AI-Trader
HKUDS
3.7
0%
Sep 3HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error
CVE-2026-61808
LI
LightRAG
HKUDS
9.8
2%
Aug 7LightRAG: Missing Authentication for Critical API Functions in Default Configuration
CVE-2026-61740
LI
LightRAG
HKUDS
9.3
1%
Jul 15LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
CVE-2026-61736
LI
LightRAG
HKUDS
9.3
1%
Jul 15LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
CVE-2026-58173
VI
Vibe-Trading
HKUDS
6.5
0%
Jun 30Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type
CVE-2026-58171
VI
Vibe-Trading
HKUDS
4.2
0%
Jun 30Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier
CVE-2026-58170
VI
Vibe-Trading
HKUDS
8.3
1%
Jun 30Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates
CVE-2026-58169
VI
Vibe-Trading
HKUDS
7.5
0%
Jun 30Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution
CVE-2026-58168
DE
DeepTutor
HKUDS
8.8
0%
Jun 30DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users
CVE-2026-56696
OP
OpenHarness
HKUDS
5.4
0%
Jun 23OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
CVE-2026-56695
OP
OpenHarness
HKUDS
6.5
0%
Jun 23OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
CVE-2026-48716
NA
nanobot
HKUDS
8.7
0%
Jun 18nanobot: Path traversal via unsanitized WhatsApp document fileName enables arbitrary file write
CVE-2026-12203
AI
AI-Trader
HKUDS
5.3
0%
Jun 15HKUDS AI-Trader Research Export agents.csv information disclosure
CVE-2026-49140
NA
nanobot
HKUDS
4.3
0%
Jun 1Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
CVE-2026-49139
NA
nanobot
HKUDS
7.0
0%
Jun 1Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
CVE-2026-49138
NA
nanobot
HKUDS
5.0
0%
Jun 1Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
CVE-2026-32847
DE
DeepCode
HKUDS
7.5
0%
May 28DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py
CVE-2026-7551
OP
OpenHarness
HKUDS
8.8
1%
Apr 30HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
CVE-2026-6823
OP
OpenHarness
HKUDS
8.2
0%
Apr 21HKUDS OpenHarness Insecure Default Remote Channel Allowlist
CVE-2026-6819
OP
OpenHarness
HKUDS
8.8
0%
Apr 21HKUDS OpenHarness Plugin Management Command Exposure
CVE-2026-6729
OP
OpenHarness
HKUDS
7.6
0%
Apr 20HKUDS OpenHarness Session Key Collision Privilege Escalation
CVE-2026-40516
OP
OpenHarness
HKUDS
6.3
0%
Apr 17OpenHarness SSRF via web_fetch and web_search
CVE-2026-40515
OP
OpenHarness
HKUDS
5.5
0%
Apr 17OpenHarness Permission Bypass via grep and glob root argument
CVE-2026-40502
OP
OpenHarness
HKUDS
8.8
2%
Apr 16OpenHarness Remote Administrative Command Injection via Gateway Handler
CVE-2026-40503
OP
OpenHarness
HKUDS
6.5
0%
Apr 16OpenHarness Path Traversal Information Disclosure via /memory show
CVE-2026-35589
NA
nanobot
HKUDS
9.3
0%
Apr 14nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)
CVE-2026-39413
LI
LightRAG
HKUDS
6.5
0%
Apr 8LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
CVE-2026-22682
OP
OpenHarness
HKUDS
7.1
0%
Apr 7OpenHarness Improper Access Control via File Tools
CVE-2026-33654
NA
nanobot
HKUDS
9.8
1%
Mar 27Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
CVE-2026-2577
NA
nanobot
HKUDS
10.0
1%
Feb 16Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge
CVE-2025-6773
LI
LightRAG
HKUDS
5.3
0%
Jun 27HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal