EUVD-2026-125609

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, question...

EUVD-2026-125608

ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/kb-id/docs/upload so that victims opening...

CVE-2026-129157

The software ragent versions 1.0.0 through 1.1.0 contains a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. By navigating the /rag/traces/runs and related node endpoints, an at...

CVE-2026-129158

The ragent 1.1.0 application contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by uploading SVG files as knowledge-base documents via the /knowledge-base/{kb-id}/docs/upload endpoint. Because the application serves these files inline as i...