Hkuds Lightrag
5 CVEs affecting Hkuds Lightrag. Latest disclosed: 2026-08-07. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61808 | Critical | 9.8 | 2026-08-07 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentic… |
CVE-2026-61736 | Critical | 9.3 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in… |
CVE-2025-6773 | Medium | 5.3 | 2025-06-27 | A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir o… |
CVE-2026-39413 | Medium | 4.2 | 2026-04-08 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an… |
CVE-2026-61740 | | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset… |