LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2026-84364 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

GHSA-G6GW-C38X-MQFC vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

GHSA-CRVJ-82CR-HJCX vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

GHSA-GQVV-2MRQ-WPJV vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

CVE-2026-84363 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

CVE-2026-84365 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard-fips, librechat, wazuh-dashboard...

GHSA-RGJ7-G3M4-5G8C vulnerabilities

Vulnerabilities for packages: keep-fips, librechat, keep, tileserver-gl-fips, zitadel, tileserver-gl, langfuse, peerdb-ui, homepage, langfuse-fips...

GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server,...

CVE-2026-67321 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server,...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: librechat, tileserver-gl-fips, tileserver-gl, lambda-nodejs, langfuse, langfuse-fips...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: librechat, tileserver-gl-fips, tileserver-gl, lambda-nodejs, langfuse, langfuse-fips...

GHSA-GCR2-9V8M-GQ45 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-68921 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-82659 vulnerabilities

Vulnerabilities for packages: librechat, unleash, kibana, langfuse, jitsucom-jitsu, langfuse-fips, unleash-fips...

The vulnerability of the deleteMessages() function on the LibreChat artificial intelligence-based platform allows a violator to gain access to the ability to delete any files.

The vulnerability of the deleteMessages function on the LibreChat artificial intelligence-based platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and delete any files they desire...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: gotenberg, cluster-autoscaler-fips, grafana-rollout-operator, flux-source-controller, nova, nova-fips, victorialogs, flux-image-reflector-controller, loki-fips, omnictl-multiarch, victoriametrics-fips, grafana-operator-fips, dkron, victoriametrics-cluster,...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, yunikorn-k8shim-fips, longhorn-backing-image-manager, sftpgo-plugin-eventstore, neuvector-sigstore-interface, sqlexporter-fips, kyverno-fips, kubescape, beats-fips, kubernetes-csi-driver-hostpath, kubernetes-csi-node-driver-registrar, cri-tools...

GO-2026-4601 vulnerabilities

Vulnerabilities for packages: aws-nuke, php-fpmexporter, kubescape-server-fips, mig-parted-fips, calico-fips, go-spdk-helper, helm-docs, yunikorn-k8shim-fips, consul-k8s, kube-mgmt, longhorn-backing-image-manager, metrics-agent-fips, neuvector-sigstore-interface, openbao-k8s-fips,...

GHSA-55Q2-FJHQ-7XH7 vulnerabilities

Vulnerabilities for packages: librechat, awx, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce-fips, wazuh-dashboard-fips, gitlab-rails-ce, kibana, langfuse, nextcloud-server, opensearch-dashboards-fips, langfuse-fips...