Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 5.9 CVE-2026-54040

LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass_CVE-2026-54040

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint r...

danny-avila LibreChat < 0.8.4-rc1 CVE
MEDIUM 6.5 CVE-2026-54037

LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork_CVE-2026-54037

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and f...

danny-avila LibreChat < 0.8.4-rc1 CVE
HIGH 7.7 CVE-2026-54033

LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs_CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-c...

danny-avila LibreChat < 0.8.4-rc1 CVE
HIGH 8 CVE-2026-54030

LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow_CVE-2026-54030

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate ...

danny-avila LibreChat < 0.8.5 CVE
MEDIUM 5.3 CVE-2026-54029

LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter_CVE-2026-54029

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId...

danny-avila LibreChat < 0.8.4-rc1 CVE
MEDIUM 6.5 CVE-2026-54027

LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization_CVE-2026-54027

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any auth...

danny-avila LibreChat < 0.8.4-rc1 CVE
MEDIUM 5.4 CVE-2026-54025

LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview_CVE-2026-54025

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown ar...

danny-avila LibreChat < 0.8.4-rc1 CVE
MEDIUM 6.5 CVE-2026-54024

LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits_CVE-2026-54024

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added ...

danny-avila LibreChat < 0.8.4-rc1 CVE
HIGH 7.2 CVE-2026-45233

HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave_CVE-2026-45233

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by s...

danpros htmly CVE
HIGH 7.5 CVE-2026-13351

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets_CVE-2026-13351

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragment...

zephyrproject-rtos Zephyr * CVE