https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 04:28:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-224006 EUVD-2026-224006 https://cve.radiocsirt.org/vuln/euvd-2026-224006 https://cve.radiocsirt.org/vuln/fkie_cve-2024-12433 <p>A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey &#39;authkey=b&#39;infiniflow-token4kevinhu&#39;&#39; which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.</p> <p>A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey &#39;authkey=b&#39;infiniflow-token4kevinhu&#39;&#39; which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-12433 https://cve.radiocsirt.org/vuln/ghsa-wr4v-pc76-3q4p <p>A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey &#39;authkey=b&#39;infiniflow-token4kevinhu&#39;&#39; which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.</p> <p>A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey &#39;authkey=b&#39;infiniflow-token4kevinhu&#39;&#39; which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.</p> https://cve.radiocsirt.org/vuln/ghsa-wr4v-pc76-3q4p