Vendor
HKUDS Vibe-Trading Missing Authentication (CVE-2026-114108)
2 rules 2 TTPs 1 CVEHKUDS Vibe-Trading versions 0.1.0 through 0.1.6 contain a missing authentication vulnerability allowing unauthenticated attackers to execute arbitrary shell commands, upload files, and access sensitive data.
Vibe-Trading Unauthenticated RCE and API Exposure
3 TTPsVibe-Trading v0.1.6 contains multiple critical vulnerabilities, including unauthenticated API access, unrestricted file uploads, and a command injection chain leading to container-level RCE when the API_AUTH_KEY is unset.
Remote Command Injection in HKUDS AnyTool Execute Endpoint
2 TTPs 1 CVEHKUDS AnyTool version 0.1.0 is vulnerable to remote OS command injection via the Execute Endpoint component, allowing unauthenticated attackers to execute arbitrary system commands.
SSRF via IPv6-Transition Address Bypass in LightRAG
2 TTPs 1 CVELightRAG versions 1.5.4 and earlier are vulnerable to Server-Side Request Forgery (SSRF) because the markdown parser fails to sanitize IPv6-encoded internal IPv4 addresses, allowing access to internal services and cloud metadata.
Remote Argument Injection in HKUDS nanobot
3 TTPs 1 CVEHKUDS nanobot versions up to 0.2.1 contain an argument injection vulnerability in the ExecTool component that allows remote attackers to execute arbitrary commands.
HKUDS OpenHarness Remote Code Execution via /bridge Slash Command (CVE-2026-7551)
2 rules 1 TTP 1 CVEHKUDS OpenHarness contains a remote code execution vulnerability (CVE-2026-7551) in the /bridge slash command, allowing remote attackers to execute arbitrary operating system commands by injecting malicious commands via the /bridge spawn command, leading to unauthorized shell access and data exposure.
HKUDS OpenHarness Plugin Management Vulnerability (CVE-2026-6819)
2 rules 3 TTPs 1 CVEHKUDS OpenHarness before PR #156 allows remote attackers with channel layer access to manage plugin lifecycle commands, enabling unauthorized plugin installation and activation.