Vendor
HKUDS vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 46 vulnerabilities in HKUDS: 0 in the last 7 days and 20 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114108, was published on 21 October 2026. 3 vulnerabilities in the last four weeks, down 80% on the four before (15). 1 critical against 2. 5 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 20
- Critical, all time
- 6
- Exploited in the wild
- 0
About HKUDS
The Data Science Lab at the University of Hong Kong.
HKUDS technologies
Latest HKUDS vulnerabilities
- CVE-2026-114108: HKUDS Vibe-Trading missing authentication in FastAPI servercriticalCVSS 9.8
- CVE-2026-114107: HKUDS Vibe-Trading indirect prompt injection in BashTool and BackgroundRunToolhighCVSS 8.8
- CVE-2026-114106: HKUDS Vibe-Trading path traversal in file-read toolshighCVSS 7.5
- Vibe-Trading FastAPI unauthenticated access and RCE chaincriticalCVSS 10
- CVE-2026-51881: DeepTutor code injection in shell execution toolinfoEPSS 0.2%
- CVE-2026-51880: deeptutor path traversal in EditFileTool.executeinfoEPSS 0.1%
- CVE-2026-51879: DeepTutor authorization bypass in TutorBotManager file writeinfoEPSS 0.1%
- CVE-2026-51878: DeepTutor authorization bypass in session regenerationinfoEPSS 0.1%
- CVE-2026-51876: DeepTutor authorization bypass in book confirmationinfoEPSS 0.1%
- CVE-2026-51870: DeepTutor command execution in ExecToolinfo
- CVE-2026-102874: HKUDS AnyTool command injection in Execute EndpointhighCVSS 7.3
- CVE-2026-85740: LightRAG SSRF via IPv6-transition address bypass in markdown image downloadhighCVSS 7.1EPSS 0.2%
- CVE-2026-85734: lightrag-hku /login endpoint missing rate limiting enables brute-force attackscriticalCVSS 9.1EPSS 0.4%
- CVE-2026-85725: LightRAG plaintext password timing attack vulnerabilitymediumCVSS 5.9EPSS 0.4%
- CVE-2026-85709: LightRAG API sensitive information exposure in error responsesmediumCVSS 5.3EPSS 0.4%
- CVE-2026-92576: HKUDS nanobot server-side request forgery in WebFetchToolhighCVSS 8.6EPSS 0.4%
- CVE-2026-90809: HKUDS nanobot argument injection in shell command executionhighCVSS 7.3EPSS 0.6%
- CVE-2026-90808: HKUDS nanobot incomplete blacklist in shell command executionmediumCVSS 6.3EPSS 0.4%
- CVE-2026-86124: AutoAgent unauthenticated remote code execution in TCP servercriticalCVSS 9.8EPSS 1.0%
- CVE-2026-85030: HKUDS AI-Trader business logic error in selfRegister APIlowCVSS 3.7EPSS 0.5%
- CVE-2026-61740: HKUDS LightRAG authentication bypass in API-key-only modecriticalCVSS 4EPSS 0.7%
- CVE-2026-61736: HKUDS LightRAG permissive CORS policy in API servercriticalCVSS 9.3EPSS 1.4%
- CVE-2026-58173: HKUDS Vibe-Trading path traversal in persistent memory storagemediumCVSS 6.5
- CVE-2026-58171: HKUDS Vibe-Trading path traversal in swarm run identifiermediumCVSS 4.2
- CVE-2026-58170: HKUDS Vibe-Trading path traversal in mandate proposal identifierhighCVSS 8.3
Most severe HKUDS vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- Vibe-Trading FastAPI unauthenticated access and RCE chaincriticalCVSS 10
- CVE-2026-86124: AutoAgent unauthenticated remote code execution in TCP servercriticalCVSS 9.8EPSS 1.0%
- CVE-2026-114108: HKUDS Vibe-Trading missing authentication in FastAPI servercriticalCVSS 9.8
- CVE-2026-61736: HKUDS LightRAG permissive CORS policy in API servercriticalCVSS 9.3EPSS 1.4%
- CVE-2026-85734: lightrag-hku /login endpoint missing rate limiting enables brute-force attackscriticalCVSS 9.1EPSS 0.4%
- CVE-2026-61740: HKUDS LightRAG authentication bypass in API-key-only modecriticalCVSS 4EPSS 0.7%
- CVE-2026-40502: HKUDS OpenHarness command injection in gateway handlerhighCVSS 8.8EPSS 1.7%
- CVE-2026-7551: HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote…highCVSS 8.8EPSS 0.7%
- CVE-2026-58168: HKUDS DeepTutor authorization bypass in MCP tool accesshighCVSS 8.8EPSS 0.4%
- CVE-2026-6819: HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin…highCVSS 8.8EPSS 0.3%
Vulnerabilities per week
3 vulnerabilities in the last four weeks, down 80% on the four before (15). 1 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 2 | 1 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 3 | 0 | |
| 21 Sep 2026 | 4 | 1 | |
| 28 Sep 2026 | 8 | 1 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 3 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many HKUDS vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/hkuds)<a href="https://junglewise.ai/threats/vendors/hkuds"><img src="https://junglewise.ai/threats/vendors/hkuds/badge.svg" alt="HKUDS vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/hkuds.json, and this page as text at https://junglewise.ai/threats/vendors/hkuds.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "HKUDS vulnerabilities", https://junglewise.ai/threats/vendors/hkuds, 9 November 2026.