https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:04:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264747 EUVD-2026-264747 https://cve.radiocsirt.org/vuln/euvd-2026-264747 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69286 <p>RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner&#39;s account. Version 0.22.0 fixes the issue.</p> <p>RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta (assistant/agent share auth) token generation process allows these tokens to be mutually derivable. Specifically, both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants them full control over the assistant/agent owner&#39;s account. Version 0.22.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69286