Vulnerabilities

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is uns…

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent p…

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools.

A vulnerability was identified in HKUDS AnyTool 0.1.0.

LightRAG provides simple and fast retrieval-augmented generation.

LightRAG provides simple and fast retrieval-augmented generation.

LightRAG provides simple and fast retrieval-augmented generation.

LightRAG provides simple and fast retrieval-augmented generation.

LightRAG provides simple and fast retrieval-augmented generation.

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses.

A vulnerability was identified in HKUDS nanobot up to 0.2.1.

A vulnerability was determined in HKUDS nanobot up to 0.2.1.

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root.

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df.

A vulnerability has been found in HKUDS nanobot up to 0.2.1.

A flaw has been found in HKUDS nanobot up to 0.2.1.

A vulnerability was detected in HKUDS nanobot up to 0.2.1.

LightRAG provides simple and fast retrieval-augmented generation.

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1.

LightRAG provides simple and fast retrieval-augmented generation.

LightRAG provides simple and fast retrieval-augmented generation.

Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequ…

Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run identifier onto the runs base directory without validation in run_dir (agent/src/swarm/store.py).

Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal identifier onto the broker proposals directory without sanitization (agent/src/live/mandate/commit.py).

Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attackers to bypass bearer-token authentication by exploiting the server's trust of TCP peer addresses for loopba…