LibreChat kayıtları
LibreChat üreticisine ait 52 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %50
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Pre-auth RCE: saldırganın hesabı olmadan, ağ üzerinden kod çalıştırabildiği açıklar. Yayından KEV’e ortanca: sahada sömürülen kayıtların yayımlanmasıyla CISA listesine girmesi arasındaki tipik süre.
Tekrar eden sınıflar
- CWE-284 Improper Access Control6
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4
- CWE-918 Server-Side Request Forgery (SSRF)4
- CWE-862 Missing Authorization4
- CWE-248 Uncaught Exception3
- CWE-285 Improper Authorization3
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
52 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | EPSS · Yayın |
|---|---|---|---|---|
40Planlayın | CVE-2026-22252İstismar yok | LibreChat MCP Stdio Remote Command Executionlibrechat · librechat · CWE-285 | Kritik9,9 | %4,212 Oca 2026 |
39İzleyin | CVE-2026-32625İstismar yok | LibreChat Exfiltrates Server Secrets via MCP Server URL Injectionlibrechat · librechat · CWE-200 | Kritik9,6 | %2,72 Haz 2026 |
39İzleyin | CVE-2024-41704İstismar yok | LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.librechat · librechat · CWE-22 | Kritik9,8 | %0,622 Tem 2024 |
39İzleyin | CVE-2024-41703İstismar yok | LibreChat through 0.7.4-rc1 has incorrect access control for message updates.librechat · librechat · CWE-284 | Kritik9,8 | %0,322 Tem 2024 |
37İzleyin | CVE-2026-54030İstismar yok | LibreChat: Missing Resource Parameter Validation in MCP OAuth Flowlibrechat · librechat · CWE-346 | Kritik9,3 | %0,125 Haz 2026 |
36İzleyin | CVE-2024-11170İstismar yok | Path Traversal in danny-avila/librechatlibrechat · librechat · CWE-29 | Yüksek8,8 | %1,820 Mar 2025 |
36İzleyin | CVE-2024-10361İstismar yok | Arbitrary File Deletion via Path Traversal in danny-avila/librechatlibrechat · librechat · CWE-22 | Kritik9,1 | %1,020 Mar 2025 |
36İzleyin | CVE-2024-52787İstismar yok | An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename iCWE-22 | Kritik9,1 | %0,725 Kas 2024 |
36İzleyin | CVE-2026-33265İstismar yok | In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.librechat · librechat · CWE-669 | Kritik9,0 | %0,218 Mar 2026 |
35İzleyin | CVE-2025-8850İstismar yok | Insecure API Design in danny-avila/librechatlibrechat · librechat · CWE-440 | Yüksek8,8 | %0,430 Eki 2025 |
34İzleyin | CVE-2025-66201İstismar yok | LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capabilitylibrechat · librechat · CWE-20 | Yüksek8,6 | %0,329 Kas 2025 |
34İzleyin | CVE-2025-66450İstismar yok | LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Uploadlibrechat · librechat · CWE-80 | Yüksek8,6 | %0,211 Ara 2025 |
34İzleyin | CVE-2026-31943İstismar yok | LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIPlibrechat · librechat · CWE-918 | Yüksek8,5 | %0,227 Mar 2026 |
33İzleyin | CVE-2025-69222İstismar yok | LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictionslibrechat · librechat · CWE-918 | Yüksek8,1 | %4,57 Oca 2026 |
32İzleyin | CVE-2026-54036İstismar yok | LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verificationlibrechat · librechat · CWE-306 | Yüksek8,1 | %0,325 Haz 2026 |
32İzleyin | CVE-2025-41258İstismar yok | LibreChat RAG API Authentication Bypasslibrechat · librechat · CWE-284 | Yüksek8,0 | %0,318 Mar 2026 |
30İzleyin | CVE-2024-11169İstismar yok | Unhandled Exception Leading to Server Crash in danny-avila/librechatlibrechat · librechat · CWE-115 | Yüksek7,5 | %0,920 Mar 2025 |
30İzleyin | CVE-2024-11172İstismar yok | Denial of Service in danny-avila/librechatlibrechat · librechat · CWE-248 | Yüksek7,5 | %0,920 Mar 2025 |
30İzleyin | CVE-2024-11171İstismar yok | Improper Input Validation in danny-avila/librechatlibrechat · librechat · CWE-770 | Yüksek7,5 | %0,520 Mar 2025 |
30İzleyin | CVE-2025-54868İstismar yok | LibreChat exposes arbitrary chats through Meilisearch enginelibrechat · librechat · CWE-285 | Yüksek7,5 | %0,55 Ağu 2025 |
30İzleyin | CVE-2025-8849İstismar yok | Denial of Service in danny-avila/librechatlibrechat · librechat · CWE-400 | Yüksek7,5 | %0,331 Eki 2025 |
30İzleyin | CVE-2026-4276İstismar yok | LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.librechat · librechat · CWE-94 | Yüksek7,5 | %0,316 Mar 2026 |
30İzleyin | CVE-2025-7104İstismar yok | Mass Assignment in danny-avila/librechatlibrechat · librechat · CWE-915 | Yüksek7,5 | %0,329 Eyl 2025 |
30İzleyin | CVE-2026-31944İstismar yok | LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect linklibrechat · librechat · CWE-306 | Yüksek7,6 | %0,213 Mar 2026 |
30İzleyin | CVE-2026-31945İstismar yok | LibreChat Server-Side Request Forgery using DNS resolutionlibrechat · librechat · CWE-918 | Yüksek7,7 | %0,227 Mar 2026 |
- CVE-2026-2225240Planlayın
LibreChat MCP Stdio Remote Command Execution
KritikCVSS 9,9İstismar yokEPSS %4librechat · librechat12 Oca 2026
- CVE-2026-3262539İzleyin
LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
KritikCVSS 9,6İstismar yokEPSS %2librechat · librechat2 Haz 2026
- CVE-2024-4170439İzleyin
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
KritikCVSS 9,8İstismar yokEPSS %0librechat · librechat22 Tem 2024
- CVE-2024-4170339İzleyin
LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
KritikCVSS 9,8İstismar yokEPSS %0librechat · librechat22 Tem 2024
- CVE-2026-5403037İzleyin
LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
KritikCVSS 9,3İstismar yokEPSS %0librechat · librechat25 Haz 2026
- CVE-2024-1117036İzleyin
Path Traversal in danny-avila/librechat
YüksekCVSS 8,8İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2024-1036136İzleyin
Arbitrary File Deletion via Path Traversal in danny-avila/librechat
KritikCVSS 9,1İstismar yokEPSS %1librechat · librechat20 Mar 2025
- CVE-2024-5278736İzleyin
An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename i
KritikCVSS 9,1İstismar yokEPSS %025 Kas 2024
- CVE-2026-3326536İzleyin
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
KritikCVSS 9,0İstismar yokEPSS %0librechat · librechat18 Mar 2026
- CVE-2025-885035İzleyin
Insecure API Design in danny-avila/librechat
YüksekCVSS 8,8İstismar yokEPSS %0librechat · librechat30 Eki 2025
- CVE-2025-6620134İzleyin
LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability
YüksekCVSS 8,6İstismar yokEPSS %0librechat · librechat29 Kas 2025
- CVE-2025-6645034İzleyin
LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload
YüksekCVSS 8,6İstismar yokEPSS %0librechat · librechat11 Ara 2025
- CVE-2026-3194334İzleyin
LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP
YüksekCVSS 8,5İstismar yokEPSS %0librechat · librechat27 Mar 2026
- CVE-2025-6922233İzleyin
LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
YüksekCVSS 8,1İstismar yokEPSS %4librechat · librechat7 Oca 2026
- CVE-2026-5403632İzleyin
LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
YüksekCVSS 8,1İstismar yokEPSS %0librechat · librechat25 Haz 2026
- CVE-2025-4125832İzleyin
LibreChat RAG API Authentication Bypass
YüksekCVSS 8,0İstismar yokEPSS %0librechat · librechat18 Mar 2026
- CVE-2024-1116930İzleyin
Unhandled Exception Leading to Server Crash in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat20 Mar 2025
- CVE-2024-1117230İzleyin
Denial of Service in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat20 Mar 2025
- CVE-2024-1117130İzleyin
Improper Input Validation in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat20 Mar 2025
- CVE-2025-5486830İzleyin
LibreChat exposes arbitrary chats through Meilisearch engine
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat5 Ağu 2025
- CVE-2025-884930İzleyin
Denial of Service in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat31 Eki 2025
- CVE-2026-427630İzleyin
LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat16 Mar 2026
- CVE-2025-710430İzleyin
Mass Assignment in danny-avila/librechat
YüksekCVSS 7,5İstismar yokEPSS %0librechat · librechat29 Eyl 2025
- CVE-2026-3194430İzleyin
LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
YüksekCVSS 7,6İstismar yokEPSS %0librechat · librechat13 Mar 2026
- CVE-2026-3194530İzleyin
LibreChat Server-Side Request Forgery using DNS resolution
YüksekCVSS 7,7İstismar yokEPSS %0librechat · librechat27 Mar 2026