7 matches found
CVE-2026-111704
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...
EUVD-2026-102996
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...
CVE-2026-111704
LangChat (through commit 2a6285a) is vulnerable to a missing authentication flaw because no Sa-Token interceptor is registered. This allows unauthenticated remote attackers to access REST controllers. Specifically, attackers can query /api/v1/auth/users to read plaintext passwords , retrieve LLM ...
PT-2026-116103
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys...
bespokelabs-curator (>=0.1.15rc1, <=0.1.15.post1), cornell (1.1.1) +21 more potentially affected by unknown CVE via vcrpy (7.0.0)
vcrpy PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vcrpy and may be impacted: - bespokelabs-curator =0.1.15rc1, =1.0.0, =0.2.16, =0.1.1, =0.1.19, =0.1.9, =0.1.0, =0.2.4rc2, =0.3.22, =2.1.0, =0.1.0, =0.0.1, =1.0.2 and more Source...