CVE-2026-12203

A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown part of the file /api/research/agents.csv of the component Research Export. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65. Applying a patch is the recommended action to fix this issue. The vendor confirms: "Research export endpoints now require an authenticated agent with the research_exports capability".

• CWE-200
• CWE-284

• https://github.com/Dave-gilmore-aus/security-advisories/blob/main/AI-Trader-Unauthenticated%20Sensitive%20Data%20Exposure%20in%20Research%20Export%20(CVE-Pending).md
• https://github.com/HKUDS/AI-Trader/
• https://github.com/HKUDS/AI-Trader/commit/91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65
• https://github.com/HKUDS/AI-Trader/issues/242
• https://github.com/HKUDS/AI-Trader/pull/227
• https://vuldb.com/cve/CVE-2026-12203
• https://vuldb.com/submit/830273
• https://vuldb.com/vuln/370846
• https://vuldb.com/vuln/370846/cti

Published

Jun 15, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12198A weakness has been identified in Microweber up to 2.0.20. T…7.3
• CVE-2026-12199A vulnerability in `nltk.app.wordnet_app` up to version 3.9.…7.5
• CVE-2026-1220Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a…7.5
• CVE-2026-12200A security vulnerability has been detected in Ritlabs TinyWe…7.3
• CVE-2026-12201A flaw has been found in IObit Malware Fighter up to 13.2.0.…5.3
• CVE-2026-12202A vulnerability has been found in Intelliants Subrion CMS up…2.4
• CVE-2026-12204A vulnerability was determined in ShopXO up to 6.7.1. This v…7.3
• CVE-2026-12205Crypt::DSA versions before 1.21 for Perl reused the nonce ac…9.1
• CVE-2026-12206A vulnerability was identified in Grit42 Grit up to 0.11.0. …6.3
• CVE-2026-12207A security flaw has been discovered in medkey-org medkey up …4.3
• CVE-2026-12208A weakness has been identified in jsonata-js jsonata up to 2…5.5
• CVE-2026-12209A security vulnerability has been detected in RubyLouvre ava…5.5