643 matches found
CVE-2026-31944
LibreChat’s breach involves the MCP OAuth callback endpoint incorrectly accepting redirects without verifying the user session or initiator. From versions 0.8.2 through 0.8.2-rc3, an attacker can lure a victim to complete the OAuth flow, causing the victim’s OAuth tokens to be stored on the attac...
LibreChat 访问控制错误漏洞
LibreChat is an open-source, free, and highly customizable unified AI dialogue platform. It allows for the aggregation and running of large models from any vendor within a single interface. Version 0.8.2 to 0.8.2-rc3 of LibreChat contains a security vulnerability related to access control. This...
PT-2026-25366
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...
CVE-2026-31944: Missing Authentication for Critical Function
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...
CVE-2026-31949: Uncaught Exception
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
LibreChat 安全漏洞
LibreChat is an open-source, free, and highly customizable unified AI conversation platform. It allows for the aggregation and running of large models from any vendor within one interface. Versions of LibreChat prior to 0.8.3-rc1 contained a security vulnerability. This vulnerability stemmed from...
PT-2026-25367
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
CVE-2026-29074 vulnerabilities
Vulnerabilities for packages: vitess, librechat, arangodb...
GHSA-XPQW-6GX7-V673 vulnerabilities
Vulnerabilities for packages: vitess, librechat, arangodb...
GHSA-VPQ2-C234-7XJ6 vulnerabilities
Vulnerabilities for packages: vitess, sqlpad, gitlab-rails-ce, kubeflow-pipelines, kibana, arangodb, langfuse-fips, gitlab-rails-ce-fips, kubeflow-katib, jitsucom-jitsu, gemini-cli, prism, opensearch-dashboards-fips, tileserver-gl-fips, redisinsight, wazuh-dashboard, argo-workflows, librechat,...
CVE-2026-3449 vulnerabilities
Vulnerabilities for packages: vitess, sqlpad, gitlab-rails-ce, kubeflow-pipelines, kibana, arangodb, langfuse-fips, gitlab-rails-ce-fips, kubeflow-katib, jitsucom-jitsu, gemini-cli, prism, opensearch-dashboards-fips, tileserver-gl-fips, redisinsight, wazuh-dashboard, argo-workflows, librechat,...
CVE-2026-29087 vulnerabilities
Vulnerabilities for packages: langfuse, opensearch-dashboards-fips, kibana, wazuh-dashboard-fips, langfuse-fips, wazuh-dashboard, librechat, opensearch-dashboards...
GHSA-WC8C-QW6V-H7F6 vulnerabilities
Vulnerabilities for packages: langfuse, opensearch-dashboards-fips, kibana, wazuh-dashboard-fips, langfuse-fips, wazuh-dashboard, librechat, opensearch-dashboards...
CVE-2026-0540 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, langfuse, opensearch-dashboards-fips, kibana, langfuse-fips, wazuh-dashboard, librechat, opensearch-dashboards...
GHSA-V2WJ-7WPQ-C8VV vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, langfuse, opensearch-dashboards-fips, kibana, langfuse-fips, wazuh-dashboard, librechat, opensearch-dashboards...
GHSA-5528-5VMV-3XC2 vulnerabilities
Vulnerabilities for packages: librechat, redisinsight...
CVE-2026-3520 vulnerabilities
Vulnerabilities for packages: librechat, redisinsight...
CVE-2026-2359 vulnerabilities
Vulnerabilities for packages: librechat, redisinsight...