AdvisoriesToolsStatsChecklistSubmitGet the email
← All tools
LLM frameworks · InfiniFlow

RAGFlow

Open-source RAG engine with agent workflows, used to build chat assistants and agents on top of your own documents.

1Advisories
0critical
1high
0medium
2026-10-30Latest
Timeline · advisories per quarter
12026 Q4
Named in sources

Reported for RAGFlow

01. highBroken access controlNew this weekCVE-2026-119337: RAGFlow's OpenAI-compatible endpoint lets any user run another user's private agent, upgrade to 0.27.3From 0.25.2 until 0.27.3, RAGFlow's POST /api/v1/agents/chat/completions returned through its OpenAI-compatible branch before checking whether the caller may use the agent. Any logged-in user who knows the UUID of someone else's 'Only me' agent can run it and read its output across user or tenant boundaries. RAGFlow 2026-10-30
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.