Vulnerabilidades em danny-avila

48 resultados
Análise Vexday

Danny-Avila apresenta 48 vulnerabilidades catalogadas, das quais 4 críticas, com 13 novas publicações nos últimos 90 dias indicando risco recente relevante. Nenhuma vulnerabilidade está sob ataque ativo conhecido (KEV), reduzindo a urgência imediata, mas a dominância de CWE-862 (controle de acesso inadequado) sugere problemas estruturais na autorização de recursos que demandam remediação estratégica.

CVE-2024-10359MEDIUMMass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechatEPSS 0.4%CVE-2024-10366HIGHIDOR in delete attachments in danny-avila/librechatEPSS 0.4%CVE-2024-10363MEDIUMImproper Access Control in danny-avila/LibreChatEPSS 0.4%CVE-2026-31945HIGHLibreChat Server-Side Request Forgery using DNS resolutionEPSS 0.4%CVE-2026-31951MEDIUMLibreChat's MCP Server Header Injection Enables OAuth Token TheftEPSS 0.4%CVE-2026-54033HIGHLibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLsEPSS 0.4%CVE-2025-41258HIGHLibreChat RAG API Authentication BypassEPSS 0.3%CVE-2026-31942HIGHLibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keysEPSS 0.3%CVE-2025-66451MEDIUMLibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission ChangesEPSS 0.3%CVE-2026-34371MEDIUMLibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename TraversalEPSS 0.3%CVE-2025-69220HIGHLibreChat has Insufficient Access Control for Agent FilesEPSS 0.3%CVE-2026-54027MEDIUMLibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload AuthorizationEPSS 0.3%CVE-2025-8849MEDIUMDenial of Service in danny-avila/librechatEPSS 0.3%CVE-2026-31943HIGHLibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIPEPSS 0.3%CVE-2025-7104MEDIUMMass Assignment in danny-avila/librechatEPSS 0.3%CVE-2026-31944HIGHLibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect linkEPSS 0.3%CVE-2025-66201HIGHLibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions CapabilityEPSS 0.3%CVE-2025-6088MEDIUMImproper Authorization in danny-avila/librechatEPSS 0.3%CVE-2026-31950MEDIUMLibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' ChatsEPSS 0.3%CVE-2025-7105MEDIUMDenial of Service via JavaScript Memory Overflow in danny-avila/librechatEPSS 0.3%