485 matches found
CVE-2026-31949
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
CVE-2026-31949 LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
EUVD-2026-12093
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
CVE-2026-31944 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...
CVE-2026-31944
LibreChat’s breach involves the MCP OAuth callback endpoint incorrectly accepting redirects without verifying the user session or initiator. From versions 0.8.2 through 0.8.2-rc3, an attacker can lure a victim to complete the OAuth flow, causing the victim’s OAuth tokens to be stored on the attac...
CVE-2026-31944 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...
LibreChat 访问控制错误漏洞
LibreChat is an open-source, free, and highly customizable unified AI dialogue platform. It allows for the aggregation and running of large models from any vendor within a single interface. Version 0.8.2 to 0.8.2-rc3 of LibreChat contains a security vulnerability related to access control. This...
PT-2026-25367
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service DoS vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler...
PT-2026-25366
LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...
LibreChat 安全漏洞
LibreChat is an open-source, free, and highly customizable unified AI conversation platform. It allows for the aggregation and running of large models from any vendor within one interface. Versions of LibreChat prior to 0.8.3-rc1 contained a security vulnerability. This vulnerability stemmed from...
CVE-2026-29074 vulnerabilities
Vulnerabilities for packages: vitess, arangodb, librechat...
CVE-2026-29087 vulnerabilities
Vulnerabilities for packages: kibana, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, langfuse-fips, wazuh-dashboard-fips, opensearch-dashboards-fips...
GHSA-XPQW-6GX7-V673 vulnerabilities
Vulnerabilities for packages: vitess, arangodb, librechat...
GHSA-V2WJ-7WPQ-C8VV vulnerabilities
Vulnerabilities for packages: kibana, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, langfuse-fips, opensearch-dashboards-fips...
GHSA-WC8C-QW6V-H7F6 vulnerabilities
Vulnerabilities for packages: kibana, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, langfuse-fips, wazuh-dashboard-fips, opensearch-dashboards-fips...
CVE-2026-3449 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-katib, gemini-cli, redisinsight, prism, opensearch-dashboards, wazuh-dashboard, sqlpad, langfuse-fips, vitess, code-server, opensearch-dashboards-fips, tileserver-gl-fips, kibana, kubeflow-pipelines, librechat, langfuse, jitsucom-jitsu,...
GHSA-VPQ2-C234-7XJ6 vulnerabilities
Vulnerabilities for packages: argo-workflows, kubeflow-katib, gemini-cli, redisinsight, prism, opensearch-dashboards, wazuh-dashboard, sqlpad, langfuse-fips, vitess, code-server, opensearch-dashboards-fips, tileserver-gl-fips, kibana, kubeflow-pipelines, librechat, langfuse, jitsucom-jitsu,...
CVE-2026-0540 vulnerabilities
Vulnerabilities for packages: kibana, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, langfuse-fips, opensearch-dashboards-fips...