CVE-2026-68929

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929: Missing Authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929

FastGPT , an open-source LLM platform, is vulnerable to unauthenticated WeChat channel hijack and denial of service in versions prior to 4.15.2 . The WeChat (iLink) share-channel endpoints authorize requests using only the publicly exposed shareId , with no authenticated identity or team-ownershi...

CVE-2026-68929

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

EUVD-2026-67310

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

PT-2026-82775

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2 Description WeChat iLink share-channel endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. Because the shareId is exposed in shared chat URLs,...

A Hybrid Security Framework for Mini-Programs: Visual UI Compliance and Network Risk Assessment

With the continuous development of the WeChat ecosystem, WeChat Mini Programs, due to their advantages of not requiring installation, using little memory, and being ready to use instantly, have seen a surge in user numbers and have now become an indispensable service carrier in mobile internet...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

CVE-2026-32467 affects the WordPress "[Aotuman] Grab WeChat Articles" plugin up to version 2.0.1. Authenticated subscribers can trigger an SSRF by causing the server to fetch arbitrary internal/external URLs, enabling internal network probing or external requests. CVSS 6.0 MEDIUM (AV:N/AC:H/PR:L/...

CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467: Server-Side Request Forgery (SSRF)

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

PT-2026-77045

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Aotuman Grab WeChat Articles versions = 2.0.1...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...