labring vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20241
3. 20254
4. 202629

Newest CVEs

• CVE-2026-84301

  FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

  labring · FastGPT

  Medium6.3
• CVE-2026-68929

  FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

  labring · FastGPT

  Critical9.3
• CVE-2026-61643

  FastGPT: workflow runtime can execute another user's private HTTP toolset

  labring · FastGPT

  Medium5.9
• CVE-2026-50562

  FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

  labring · FastGPT

  Critical9.3
• CVE-2026-61646

  FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects

  labring · FastGPT

  Medium6.3
• CVE-2026-61644

  FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup

  labring · FastGPT

  High7.7
• CVE-2026-61684

  FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')

  labring · FastGPT

  High8.8
• CVE-2026-54602

  FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

  labring · FastGPT

  High7.1
• CVE-2026-54607

  FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)

  labring · FastGPT

  High7.7
• CVE-2026-55418

  FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

  labring · FastGPT

  High8.6