Browse CVEs

HIGH 7.7 CVE-2026-31945 LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack… Librechat No fix yet Fix from $1,9502026-03-27 MEDIUM 5.3 CVE-2026-31950 LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:… Librechat No fix yet Fix from $1,6002026-03-27 CRITICAL 9.0 CVE-2026-33265 In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. Librechat No fix yet Fix from $2,3002026-03-18 HIGH 8.0 CVE-2025-41258 LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of… Librechat No fix yet Fix from $1,9502026-03-18 HIGH 7.5 CVE-2026-4276 LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries. Librechat Mitigation only Fix from $1,9502026-03-16 HIGH 7.6 CVE-2026-31944 LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the … Librechat No fix yet Fix from $1,9502026-03-13 MEDIUM 5.4 CVE-2025-8848 A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP … Librechat No fix yet Fix from $1,6002025-10-22