PatchSiren

HKUDS CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM HKUDS CVE published 2026-06-15

CVE-2026-12203

CVE-2026-12203 is a MEDIUM severity vulnerability in AI-Trader. The vulnerability affects the Research Export component, specifically the file /api/research/agents.csv. An attacker can exploit this vulnerability remotely, resulting in information disclosure. The CVSS score for this vulnerability is 5.5.

HIGH HKUDS CVE published 2026-05-28

CVE-2026-32847

A path traversal vulnerability in DeepCode's SPA catch-all route allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to bypass Starlette's path normalization. The vulnerability exists in new_ui/backend/main.py through commit c991dc2. Attackers can encode slashes as %2F and dots as %2E%2E to traverse outside the FRONTEND_DIST directory, exposing sensitive fil [truncated]

HIGH HKUDS CVE published 2026-04-17

CVE-2026-40516

CVE-2026-40516 is a high-severity vulnerability in OpenHarness, a tool for continuous integration and delivery. The vulnerability allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. This can be done by influencing an agent session to invoke the web_fetch and web_search tools against loopback, RFC1918, link-local, or [truncated]

HIGH HKUDS CVE published 2026-04-17

CVE-2026-40515

CVE-2026-40515 is a high-severity vulnerability in OpenHarness that allows attackers to read sensitive files due to incomplete path normalization. The vulnerability exists in OpenHarness before commit bd4df81 and is caused by the permission checker's incomplete path normalization, allowing attackers to invoke built-in grep and glob tools with sensitive root directories. Users of OpenHarness should be awar [truncated]

HIGH HKUDS CVE published 2026-04-16

CVE-2026-40503

CVE-2026-40503 is a path traversal vulnerability in OpenHarness prior to commit dd1d235. This CVE record was published on 2026-04-16T01:16:11.440Z and was last modified on 2026-07-14T21:16:48.147Z. The vulnerability allows remote gateway users with chat access to read arbitrary files by supplying path traversal sequences to the /memory show slash command. This could potentially lead to unauthorized access [truncated]

HIGH HKUDS CVE published 2026-04-16

CVE-2026-40502

CVE-2026-40502 is a high-severity command injection vulnerability in OpenHarness prior to commit dd1d235. Remote gateway users with chat access can exploit this vulnerability to invoke sensitive administrative commands. The vulnerability exists due to insufficient distinction between local-only and remote-safe commands in the gateway handler. This issue allows attackers to execute administrative commands [truncated]

HIGH HKUDS CVE published 2026-04-07

CVE-2026-22682

CVE-2026-22682 is an improper access control vulnerability in OpenHarness built-in file tools. Attackers can exploit inconsistent parameter handling in permission enforcement to read arbitrary local files outside the intended repository scope. This could allow access to sensitive files such as configuration files, credentials, and SSH material. The vulnerability exists in OpenHarness prior to commit 166fcfe.