Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: HKUDS Vibe-Trading 0.1.10 Clear all filters
TI-2026-41891 CVE-2026-58173 · GHSA-3j25-mjx3-pwg4

Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type

Priority MEDIUM 60

Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequ…

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00447 Published 2026-06-30 Fixed in 0.1.10 CWE-22
TI-2026-41889 CVE-2026-58171 · GHSA-mjrq-xg2m-qg94

Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier

Priority LOW 12

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py).

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00344 Published 2026-06-30 Fixed in 0.1.10 CWE-22
TI-2026-41887 CVE-2026-58169 · GHSA-q796-5g5h-cqcc

Origin validation error in HKUDS Vibe-Trading

Priority LOW 36

Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopba…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00418 Published 2026-06-30 Fixed in 0.1.10 CWE-346