LO
Vendor
lobehub
21
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85621 | LO lobehub lobehub | 6.5 | Sep 4 | LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu |
| CVE-2026-72594 | LO lobe-chat lobehub | 7.6 | Aug 10 | lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload |
| CVE-2026-59100 | LO lobehub lobehub | 5.0 | Jul 2 | LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations |
| CVE-2026-59098 | LO lobehub lobehub | 6.5 | Jul 2 | LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search |
| CVE-2026-59095 | LO lobehub lobehub | 7.7 | Jul 2 | LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl |
| CVE-2026-58580 | LO lobehub lobehub | 5.9 | Jul 2 | LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes |
| CVE-2026-58578 | LO lobehub lobehub | 6.5 | Jul 2 | LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import |
| CVE-2026-54157 | LO lobehub lobehub | 9.0 | Jun 23 | LobeHub: Unauthenticated SSRF in `/webapi/proxy` |
| CVE-2026-42045 | LO lobehub lobehub | 6.2 | May 12 | LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) |
| CVE-2026-39411 | LO lobehub lobehub | 7.1 | Apr 8 | LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header |
| CVE-2026-23835 | LO lobe-chat lobehub | 5.7 | Jan 30 | LobeHub Vulnerable to Improper Authorization in Presigned Upload |
| CVE-2026-23522 | LO lobe-chat lobehub | 3.7 | Jan 19 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-23733 | LO lobe-chat lobehub | 6.4 | Jan 18 | Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) |
| CVE-2025-62505 | LO lobe-chat lobehub | 3.0 | Oct 17 | SSRF in lobehub/lobe-chat with native web fetch module |
| CVE-2025-59426 | LO lobe-chat lobehub | 4.3 | Sep 25 | lobe-chat has an Open Redirect |
| CVE-2025-59417 | LO lobe-chat lobehub | 6.1 | Sep 18 | Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages |
| CVE-2024-32965 | LO lobe-chat lobehub | 8.6 | Nov 26 | ssrf vulnerability in lobe-chat |
| CVE-2024-47066 | LO lobe-chat lobehub | 8.8 | Sep 23 | Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) |
| CVE-2024-37895 | LO lobe-chat lobehub | 5.7 | Jun 17 | API Key Leak in lobe-chat |
| CVE-2024-32964 | LO lobe-chat lobehub | 9.0 | May 10 | lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability |
| CVE-2024-24566 | LO lobe-chat lobehub | 5.3 | Jan 31 | Lobe Chat unauthorized access to plugins |