danny-avila vulnerabilities
48 published CVEs name danny-avila among the affected products.
- 48Published CVEs48 of them scored
- 30Last 12 monthspublished in the last year
- 4Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-54024
LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
danny-avila · LibreChat
Medium6.5 - CVE-2026-54025
LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview
danny-avila · LibreChat
Medium5.4 - CVE-2026-54027
LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
danny-avila · LibreChat
Medium6.5 - CVE-2026-54029
LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
danny-avila · LibreChat
Medium5.3 - CVE-2026-54033
LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
danny-avila · LibreChat
High7.7 - CVE-2026-54037
LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
danny-avila · LibreChat
Medium6.5 - CVE-2026-54030
LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
danny-avila · LibreChat
High8.0 - CVE-2026-54040
LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass
danny-avila · LibreChat
Medium5.9 - CVE-2026-54036
LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
danny-avila · LibreChat
Medium5.3 - CVE-2026-44654
LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents
danny-avila · LibreChat
Medium5.7