LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

GHSA-QQMP-WF37-98F9 vulnerabilities

Vulnerabilities for packages: kibana, zitadel, librechat, azurite...

CVE-2026-104872 vulnerabilities

Vulnerabilities for packages: kibana, zitadel, librechat, azurite...

GHSA-VM5R-23W9-M8HX vulnerabilities

Vulnerabilities for packages: unleash-fips, langfuse, langfuse-fips, librechat...

CVE-2026-90776 vulnerabilities

Vulnerabilities for packages: unleash-fips, langfuse, langfuse-fips, librechat...

GHSA-3WCJ-GJVF-FVCH vulnerabilities

Vulnerabilities for packages: langfuse-fips, librechat, opensearch-dashboards-fips, kibana, langfuse, opensearch-dashboards...

CVE-2026-56763 vulnerabilities

Vulnerabilities for packages: langfuse-fips, librechat, opensearch-dashboards-fips, kibana, langfuse, opensearch-dashboards...

GHSA-JXRP-R7GX-Q4J8 vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, librechat, opensearch-dashboards-fips, wazuh-dashboard, wazuh-dashboard-fips, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, kibana, langfuse, gitlab-rails-ce, opensearch-dashboards, awx, jupyter-base-notebook...

CVE-2026-66010 vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, librechat, opensearch-dashboards-fips, wazuh-dashboard, wazuh-dashboard-fips, gitlab-rails-ce-fips, tensorflow-gpu-jupyter, kibana, langfuse, gitlab-rails-ce, opensearch-dashboards, awx, jupyter-base-notebook...

GHSA-HXH3-VQPV-XPQV vulnerabilities

Vulnerabilities for packages: librechat, commercial-gitlab-rails-ee-fips, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee...

GHSA-6623-4Q32-82V8 vulnerabilities

Vulnerabilities for packages: librechat, commercial-gitlab-rails-ee-fips, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee...

GHSA-PRGH-XP8R-P3M5 vulnerabilities

Vulnerabilities for packages: unleash-fips, langfuse, langfuse-fips, librechat...

CVE-2026-93981 vulnerabilities

Vulnerabilities for packages: librechat, commercial-gitlab-rails-ee-fips, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee...

CVE-2026-101905 vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, lerna,...

GHSA-VH66-26GQ-Q6X8 vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, lerna,...

GHSA-X97P-JQ2G-JP4F vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, azurite, lerna,...

GHSA-4HQW-QXG8-JXX2 vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, lerna,...

GHSA-9FR6-4GFG-395G vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, azurite, lerna,...

GHSA-MGHH-PGCX-3JJJ vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, lerna,...

GHSA-3PQ3-5FJ3-CG6V vulnerabilities

Vulnerabilities for packages: langfuse-fips, nextcloud-server, commercial-gitlab-rails-ee-fips, wazuh-dashboard, gitlab-rails-ce-fips, langfuse, gitlab-rails-ce, redisinsight, semaphore, opensearch-dashboards, librechat, commercial-gitlab-rails-ee, wazuh-dashboard-fips, lerna,...