danny-avila vulnerabilities

CVEs per yearBy the year they were published

1. 202522
2. 202626

Newest CVEs

• CVE-2026-54024

  LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits

  danny-avila · LibreChat

  Medium6.5
• CVE-2026-54025

  LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview

  danny-avila · LibreChat

  Medium5.4
• CVE-2026-54027

  LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization

  danny-avila · LibreChat

  Medium6.5
• CVE-2026-54029

  LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter

  danny-avila · LibreChat

  Medium5.3
• CVE-2026-54033

  LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs

  danny-avila · LibreChat

  High7.7
• CVE-2026-54037

  LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork

  danny-avila · LibreChat

  Medium6.5
• CVE-2026-54030

  LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow

  danny-avila · LibreChat

  High8.0
• CVE-2026-54040

  LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass

  danny-avila · LibreChat

  Medium5.9
• CVE-2026-54036

  LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification

  danny-avila · LibreChat

  Medium5.3
• CVE-2026-44654

  LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents

  danny-avila · LibreChat

  Medium5.7