librechat kayıtları
librechat üreticisine ait 52 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %50
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-284 Improper Access Control6
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4
- CWE-918 Server-Side Request Forgery (SSRF)4
- CWE-862 Missing Authorization4
- CWE-248 Uncaught Exception3
- CWE-285 Improper Authorization3
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
52 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2026-22252İstismar yok | LibreChat MCP Stdio Remote Command Executionlibrechat · librechat · CWE-285 | Kritik9,9 | — | %4,1 | 12 Oca 2026 |
39İzleyin | CVE-2024-41704İstismar yok | LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.librechat · librechat · CWE-22 | Kritik9,8 | — | %0,7 | 22 Tem 2024 |
39İzleyin | CVE-2024-41703İstismar yok | LibreChat through 0.7.4-rc1 has incorrect access control for message updates.librechat · librechat · CWE-284 | Kritik9,8 | — | %0,4 | 22 Tem 2024 |
38İzleyin | CVE-2026-32625İstismar yok | LibreChat Exfiltrates Server Secrets via MCP Server URL Injectionlibrechat · librechat · CWE-200 | Kritik9,6 | — | %0,4 | 2 Haz 2026 |
37İzleyin | CVE-2026-54030İstismar yok | LibreChat: Missing Resource Parameter Validation in MCP OAuth Flowlibrechat · librechat · CWE-346 | Kritik9,3 | — | %0,2 | 25 Haz 2026 |
36İzleyin | CVE-2024-11170İstismar yok | Path Traversal in danny-avila/librechatlibrechat · librechat · CWE-29 | Yüksek8,8 | — | %1,8 | 20 Mar 2025 |
36İzleyin | CVE-2024-10361İstismar yok | Arbitrary File Deletion via Path Traversal in danny-avila/librechatlibrechat · librechat · CWE-22 | Kritik9,1 | — | %1,0 | 20 Mar 2025 |
36İzleyin | CVE-2024-52787İstismar yok | An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename iCWE-22 | Kritik9,1 | — | %0,8 | 25 Kas 2024 |
36İzleyin | CVE-2026-33265İstismar yok | In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.librechat · librechat · CWE-669 | Kritik9,0 | — | %0,3 | 18 Mar 2026 |
35İzleyin | CVE-2025-8850İstismar yok | Insecure API Design in danny-avila/librechatlibrechat · librechat · CWE-440 | Yüksek8,8 | — | %0,4 | 30 Eki 2025 |
34İzleyin | CVE-2026-31943İstismar yok | LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIPlibrechat · librechat · CWE-918 | Yüksek8,5 | — | %0,3 | 27 Mar 2026 |
34İzleyin | CVE-2025-66201İstismar yok | LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capabilitylibrechat · librechat · CWE-20 | Yüksek8,6 | — | %0,3 | 28 Kas 2025 |
34İzleyin | CVE-2025-66450İstismar yok | LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Uploadlibrechat · librechat · CWE-80 | Yüksek8,6 | — | %0,2 | 11 Ara 2025 |
33İzleyin | CVE-2025-69222İstismar yok | LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictionslibrechat · librechat · CWE-918 | Yüksek8,1 | — | %4,7 | 7 Oca 2026 |
32İzleyin | CVE-2026-54036İstismar yok | LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verificationlibrechat · librechat · CWE-306 | Yüksek8,1 | — | %0,4 | 25 Haz 2026 |
32İzleyin | CVE-2025-41258İstismar yok | LibreChat RAG API Authentication Bypasslibrechat · librechat · CWE-284 | Yüksek8,0 | — | %0,3 | 18 Mar 2026 |
30İzleyin | CVE-2024-11169İstismar yok | Unhandled Exception Leading to Server Crash in danny-avila/librechatlibrechat · librechat · CWE-115 | Yüksek7,5 | — | %0,9 | 20 Mar 2025 |
30İzleyin | CVE-2024-11172İstismar yok | Denial of Service in danny-avila/librechatlibrechat · librechat · CWE-248 | Yüksek7,5 | — | %0,9 | 20 Mar 2025 |
30İzleyin | CVE-2024-11171İstismar yok | Improper Input Validation in danny-avila/librechatlibrechat · librechat · CWE-770 | Yüksek7,5 | — | %0,5 | 20 Mar 2025 |
30İzleyin | CVE-2026-4276İstismar yok | LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.librechat · librechat · CWE-94 | Yüksek7,5 | — | %0,5 | 16 Mar 2026 |
30İzleyin | CVE-2025-54868İstismar yok | LibreChat exposes arbitrary chats through Meilisearch enginelibrechat · librechat · CWE-285 | Yüksek7,5 | — | %0,4 | 5 Ağu 2025 |
30İzleyin | CVE-2026-31945İstismar yok | LibreChat Server-Side Request Forgery using DNS resolutionlibrechat · librechat · CWE-918 | Yüksek7,7 | — | %0,4 | 27 Mar 2026 |
30İzleyin | CVE-2025-8849İstismar yok | Denial of Service in danny-avila/librechatlibrechat · librechat · CWE-400 | Yüksek7,5 | — | %0,3 | 30 Eki 2025 |
30İzleyin | CVE-2025-7104İstismar yok | Mass Assignment in danny-avila/librechatlibrechat · librechat · CWE-915 | Yüksek7,5 | — | %0,3 | 29 Eyl 2025 |
30İzleyin | CVE-2026-31944İstismar yok | LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect linklibrechat · librechat · CWE-306 | Yüksek7,6 | — | %0,3 | 13 Mar 2026 |
- CVE-2026-2225240Planlayın
LibreChat MCP Stdio Remote Command Execution
KritikCVSS 9,9İstismar yokEPSS %4librechat · librechat12 Oca 2026
- CVE-2024-4170439İzleyin
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
KritikCVSS 9,8İstismar yokEPSS %1librechat · librechat22 Tem 2024
- CVE-2024-4170339İzleyin
LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
KritikCVSS 9,8İstismar yokEPSS %0librechat · librechat22 Tem 2024
- CVE-2026-3262538İzleyin
LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
KritikCVSS 9,6İstismar yokEPSS %0librechat · librechat2 Haz 2026
- CVE-2026-5403037İzleyin
LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
KritikCVSS 9,3İstismar yokEPSS %0librechat · librechat25 Haz 2026
- CVE-2024-1117036İzleyin
Path Traversal in danny-avila/librechat
YüksekCVSS 8,8İstismar yokEPSS %2librechat · librechat20 Mar 2025
- CVE-2024-1036136İzleyin
Arbitrary File Deletion via Path Traversal in danny-avila/librechat
KritikCVSS 9,1İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2024-5278736İzleyin
An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename i
KritikCVSS 9,1İstismar yokEPSS %125 Kas 2024
- CVE-2026-3326536İzleyin
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
KritikCVSS 9,0İstismar yokEPSS %0librechat · librechat18 Mar 2026
- CVE-2025-885035İzleyin
Insecure API Design in danny-avila/librechat
YüksekCVSS 8,8İstismar yokEPSS %0librechat · librechat30 Eki 2025
- CVE-2026-3194334İzleyin
LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP
YüksekCVSS 8,5İstismar yokEPSS %0librechat · librechat27 Mar 2026
- CVE-2025-6620134İzleyin
LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability
YüksekCVSS 8,6İstismar yokEPSS %0librechat · librechat28 Kas 2025
- CVE-2025-6645034İzleyin
LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload
YüksekCVSS 8,6İstismar yokEPSS %0librechat · librechat11 Ara 2025
- CVE-2025-6922233İzleyin
LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
YüksekCVSS 8,1İstismar yokEPSS %5librechat · librechat7 Oca 2026
- CVE-2026-5403632İzleyin
LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
YüksekCVSS 8,1İstismar yokEPSS %0librechat · librechat25 Haz 2026
- CVE-2025-4125832İzleyin
LibreChat RAG API Authentication Bypass
YüksekCVSS 8,0İstismar yokEPSS %0librechat · librechat18 Mar 2026
- CVE-2024-1116930İzleyin
Unhandled Exception Leading to Server Crash in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2024-1117230İzleyin
Denial of Service in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2024-1117130İzleyin
Improper Input Validation in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2026-427630İzleyin
LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat16 Mar 2026
- CVE-2025-5486830İzleyin
LibreChat exposes arbitrary chats through Meilisearch engine
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat5 Ağu 2025
- CVE-2026-3194530İzleyin
LibreChat Server-Side Request Forgery using DNS resolution
YüksekCVSS 7,7İstismar yokEPSS %0librechat · librechat27 Mar 2026
- CVE-2025-884930İzleyin
Denial of Service in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat30 Eki 2025
- CVE-2025-710430İzleyin
Mass Assignment in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat29 Eyl 2025
- CVE-2026-3194430İzleyin
LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
YüksekCVSS 7,6İstismar yokEPSS %0librechat · librechat13 Mar 2026