Login Request a demo
LA
Vendor
labring
2 products with CVEs on record
35
CVEs
0
On KEV
0
New 30D
Products
FA
FastGPT
labring
10.0
33 CVEs0 on KEV0 new
LA
laf
labring
9.1
2 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-84301
FA
FastGPT
labring
6.3
0%
Sep 22FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
CVE-2026-68929
FA
FastGPT
labring
9.3
0%
Aug 27FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
CVE-2026-61643
FA
FastGPT
labring
5.9
0%
Jul 15FastGPT: workflow runtime can execute another user's private HTTP toolset
CVE-2026-50562
FA
FastGPT
labring
9.3
0%
Jul 15FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows
CVE-2026-61646
FA
FastGPT
labring
6.3
0%
Jul 15FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects
CVE-2026-61644
FA
FastGPT
labring
7.7
0%
Jul 15FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup
CVE-2026-61684
FA
FastGPT
labring
8.8
0%
Jul 15FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')
CVE-2026-54602
FA
FastGPT
labring
7.1
0%
Jul 7FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord
CVE-2026-54607
FA
FastGPT
labring
7.7
0%
Jul 7FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)
CVE-2026-55418
FA
FastGPT
labring
8.6
0%
Jul 7FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)
CVE-2026-54601
FA
FastGPT
labring
6.3
0%
Jul 7FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion
CVE-2026-44287
FA
FastGPT
labring
6.3
0%
May 29FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
CVE-2026-44285
FA
FastGPT
labring
7.7
0%
May 29FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API
CVE-2026-44286
FA
FastGPT
labring
2.3
0%
May 8FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation
CVE-2026-44284
FA
FastGPT
labring
6.3
0%
May 8FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution
CVE-2026-42345
FA
FastGPT
labring
7.7
0%
May 8FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot
CVE-2026-42344
FA
FastGPT
labring
6.3
0%
May 8FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints
CVE-2026-42343
FA
FastGPT
labring
6.3
0%
May 8FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion
CVE-2026-42302
FA
FastGPT
labring
9.8
1%
May 8FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox
CVE-2026-40352
FA
FastGPT
labring
8.8
0%
Apr 17FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
CVE-2026-40351
FA
FastGPT
labring
9.8
1%
Apr 17FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
CVE-2026-40252
FA
FastGPT
labring
8.1
0%
Apr 10Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT
CVE-2026-40100
FA
FastGPT
labring
5.3
0%
Apr 10FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default
CVE-2026-34162
FA
FastGPT
labring
10.0
0%
Mar 31FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft
CVE-2026-34163
FA
FastGPT
labring
7.7
0%
Mar 31Server-Side Request Forgery via MCP Tools Endpoint in FastGPT
CVE-2026-33075
FA
FastGPT
labring
8.8
0%
Mar 20FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml
CVE-2026-32128
FA
FastGPT
labring
6.3
0%
Mar 11FastGPT Python Sandbox Bypass of File-Write Restriction
CVE-2026-26075
FA
FastGPT
labring
5.4
0%
Feb 12Cross-Site Request Forgery (CSRF) in FastGPT
CVE-2026-26003
FA
FastGPT
labring
5.4
0%
Feb 10FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack
CVE-2025-62612
FA
FastGPT
labring
5.3
0%
Oct 22FastGPT File Reading Node SSRF Vulnerability
CVE-2025-52552
FA
FastGPT
labring
6.1
0%
Jun 21FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS
CVE-2025-49131
FA
FastGPT
labring
9.9
0%
Jun 9FastGPT Sandbox Vulnerable to Sandbox Bypass
CVE-2025-27600
FA
FastGPT
labring
6.5
0%
Mar 6FastGPT SSRF
CVE-2023-50253
LA
laf
labring
6.5
1%
Jan 3laf logs leak
CVE-2023-48225
LA
laf
labring
9.1
1%
Dec 12Laf env causes sensitive information disclosure