CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,200 CVEs published, 235 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,200
Show in the list
Critical, last 7 days
235
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product librechat:librechat. Show all products

36 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-54024Medium 6.5LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54025Medium 5.4LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54027Medium 6.5LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54029Medium 5.3LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54033High 7.7LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54037Medium 6.5LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54030High 8.0LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54040Medium 5.9LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-54036Medium 5.3LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
Assigned by GitHub_M
Jun 25, 2026
CVE-2026-44654Medium 5.7LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents
Assigned by GitHub_M
Jun 2, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.