Filtered by vendor Nageoffer
Subscriptions
Filtered by product Ragent
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-129158 | 1 Nageoffer | 1 Ragent | 2026-11-14 | 5.4 Medium |
| ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover. | ||||
| CVE-2026-129157 | 1 Nageoffer | 1 Ragent | 2026-11-14 | 4.3 Medium |
| ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details. | ||||
Page 1 of 1.