2
CVEs
0
Critical
0
High
0
KEV
1
PoC
0
Unpatched C/H
50.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (9)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85030 | Business logic manipulation in HKUDS AI-Trader's unauthenticated selfRegister API endpoint allows remote attackers to supply an arbitrary initial_balance value, inflating their simulated starting cash in the trading competition platform. Critically, the description confirms that profit_percent_for_display() and challenge scoring's return_pct both normalize against the inflated starting capital, making percentage-based returns immune; exploitation achieves only cosmetic inflation of absolute cash and equity leaderboard columns, not artificial percent-return gains. A public proof-of-concept exploit exists per a GitHub security advisory and VulDB entry 398295, though no active exploitation (KEV) has been identified. | LOW | 2.9 | 0.4% | 35 |
PoC
No patch
|
| CVE-2026-90809 | Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass the command allowlist/denylist filter by embedding newline or carriage-return characters in a command string, causing injected shell segments to execute without inspection. Affected versions are nanobot 0.2.0 and 0.2.1; the root cause is that `_split_shell_segments()` recognized `;` and `|` as command-chain delimiters but not `\n` or `\r`, so a payload on its own line was never checked against allow/deny patterns. No public exploit or CISA KEV listing is identified; patch commit af582246 is available. | MEDIUM | 6.9 | 0.3% | 34 |
|