H
Vendor security profile
hkuds
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs22
Critical4
CISA KEV0
Public exploit18
Patch rate%50
Avg. CVSS6.7
12-month vulnerability rate
0
0
0
0
0
5
1
1
0
5
10
0
CVE KEV
CVE severity distribution
22toplam CVE
Critical4 (18%)
High3 (14%)
Medium15 (68%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%82
Public exploit
11Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
6.9
CVE-2026-102874
HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
H
Patch status unknownEPSS %1
6.1
CVE-2026-86062
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
H
Patch status unknownEPSS %0
7.1
CVE-2026-85740
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
H
Patch status unknownEPSS %0
9.1
CVE-2026-85734
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
H
Patch status unknownEPSS %0
5.9
CVE-2026-85725
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
H
Patch status unknownEPSS %0
5.3
CVE-2026-85709
LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
H
Patch status unknownEPSS %0
9.2
CVE-2026-92576
HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
H
Patch status unknownEPSS %0
6.9
CVE-2026-90809
HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection
H
Patch verifiedEPSS %1
5.3
CVE-2026-90808
HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
H
Patch verifiedEPSS %0
9.3
CVE-2026-86124
AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
H
Patch status unknownEPSS %1