CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

CVE-2026-54033 LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

EUVD-2026-39460

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

CVE-2026-54033 LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

CVE-2026-54845

creationtimestamp| type| source ---|---|--- 2026-06-25 15:46:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4rmsapsq2e...

CVE-2025-52465

creationtimestamp| type| source ---|---|--- 2026-06-25 15:43:14+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mp4rgsnbo32d 2026-06-25 19:09:33+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3mp54xqzyzc2i 2026-07-14 01:00:05+00:00| seen|...

CVE-2026-57532

creationtimestamp| type| source ---|---|--- 2026-06-25 15:33:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4qvh524y2z...

CVE-2026-54838

creationtimestamp| type| source ---|---|--- 2026-06-25 15:19:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4q4kjr7m2f 2026-06-28 07:16:21+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpdgj7nrhr2z...

CVE-2026-8690

creationtimestamp| type| source ---|---|--- 2026-06-25 15:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4pwec2uf2l...

CVE-2018-13005

creationtimestamp| type| source ---|---|--- 2026-06-25 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp4nqlgyjd2t...

CVE-2026-57535

Content injected to PDF rendering contexts could, in many places, include HTML content including tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server a...

CVE-2026-8617

creationtimestamp| type| source ---|---|--- 2026-06-25 14:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4ml2unxc2v...

CVE-2026-39938

creationtimestamp| type| source ---|---|--- 2026-06-25 13:45:18+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-cacti-1 2026-06-26 02:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp5vy2ghdl2n 2026-06-30 00:25:22+00:00| seen|...

GHSA-QFF7-4Q6C-M8H6

creationtimestamp| type| source ---|---|--- 2026-06-25 13:36:57+00:00| seen| https://bsky.app/profile/thomasp.social.vivaldi.net.ap.brid.gy/post/3mp4kdyhji2h2...

CVE-2018-20605

creationtimestamp| type| source ---|---|--- 2026-06-25 13:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp4ipolsk22n...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-53269

creationtimestamp| type| source ---|---|--- 2026-06-25 10:29:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp47wn22bc27 2026-07-06 06:52:05+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-07-09 07:45:41+00:00| seen...

CVE-2020-7610

creationtimestamp| type| source ---|---|--- 2026-06-25 10:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp46nrvwb42h...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...