Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: HKUDS Vibe-Trading 0.1.7 Clear all filters
TI-2026-78721 CVE-2026-114108

Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE

Priority HIGH 81

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is uns…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00528 Published 2026-10-21 Fixed in 0.1.7 CWE-306
TI-2026-78720 CVE-2026-114107

Indirect prompt injection in HKUDS Vibe-Trading allows remote command execution

Priority MEDIUM 40

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent p…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00576 Published 2026-10-21 Fixed in 0.1.7 CWE-1427
TI-2026-78719 CVE-2026-114106

HKUDS Vibe-Trading Path Traversal Exposes Server Files

Priority MEDIUM 44

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-10-21 Fixed in 0.1.7 CWE-22