These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in LightRAG, a retrieval-augmented generation library, allows an attacker to supply an external image URL that can be used to fetch internal resources. This issue is fixed in version 1.5.5. The vulnerability arises from inadequate validation of external image URLs, which can lead to unauthorized access to internal resources. Defenders should assess their exposure and verify their LightRAG [truncated]
A timing oracle vulnerability exists in LightRAG's password verification process prior to version 1.5.5. This issue allows a network attacker with low-latency access to recover plaintext-configured password character by character by repeatedly querying the /login endpoint. The vulnerability is due to the use of Python's == operator for comparing plaintext password values, which can return after the first [truncated]
CVE-2026-61808 is a critical vulnerability in LightRAG, a retrieval-augmented generation system, which allows unauthenticated network attackers to read, modify, or delete documents, and consume resources. The issue is mitigated in version 1.5.5rc1. LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentic [truncated]
CVE-2026-12203 is a MEDIUM severity vulnerability in AI-Trader. The vulnerability affects the Research Export component, specifically the file /api/research/agents.csv. An attacker can exploit this vulnerability remotely, resulting in information disclosure. The CVSS score for this vulnerability is 5.5.
A path traversal vulnerability in DeepCode's SPA catch-all route allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to bypass Starlette's path normalization. The vulnerability exists in new_ui/backend/main.py through commit c991dc2. Attackers can encode slashes as %2F and dots as %2E%2E to traverse outside the FRONTEND_DIST directory, exposing sensitive fil [truncated]
CVE-2026-40516 is a high-severity vulnerability in OpenHarness, a tool for continuous integration and delivery. The vulnerability allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. This can be done by influencing an agent session to invoke the web_fetch and web_search tools against loopback, RFC1918, link-local, or [truncated]
CVE-2026-40515 is a high-severity vulnerability in OpenHarness that allows attackers to read sensitive files due to incomplete path normalization. The vulnerability exists in OpenHarness before commit bd4df81 and is caused by the permission checker's incomplete path normalization, allowing attackers to invoke built-in grep and glob tools with sensitive root directories. Users of OpenHarness should be awar [truncated]
CVE-2026-40503 is a path traversal vulnerability in OpenHarness prior to commit dd1d235. This CVE record was published on 2026-04-16T01:16:11.440Z and was last modified on 2026-07-14T21:16:48.147Z. The vulnerability allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. This could potentially lead to unauthorized access [truncated]
CVE-2026-40502 is a high-severity command injection vulnerability in OpenHarness prior to commit dd1d235. Remote gateway users with chat access can exploit this vulnerability to invoke sensitive administrative commands. The vulnerability exists due to insufficient distinction between local-only and remote-safe commands in the gateway handler. This issue allows attackers to execute administrative commands [truncated]
CVE-2026-22682 is an improper access control vulnerability in OpenHarness built-in file tools. Attackers can exploit inconsistent parameter handling in permission enforcement to read arbitrary local files outside the intended repository scope. This could allow access to sensitive files such as configuration files, credentials, and SSH material. The vulnerability exists in OpenHarness prior to commit 166fcfe.