CVE Tools
Track your stack

Danny-avila

31 CVEs tracked since 2025. Since Mar 2025, none of them reached CISA KEV.

Danny-avila CVEs per month

Mar 2025 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Danny-avila CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-03110
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-0370
2026-046 or fewer
2026-057 or fewer
2026-06130
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Danny-avila's monthly top three, with their CVEs summed over those months.

  1. Librechat202 months
  2. Danny-avila/librechat111 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Danny-avila.

  1. CVE-2026-54024LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits6.5
  2. CVE-2026-54025LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview5.4
  3. CVE-2026-54027LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization6.5
  4. CVE-2026-54029LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter5.3
  5. CVE-2026-54033LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs7.7
  6. CVE-2026-54037LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork6.5
  7. CVE-2026-54030LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow8.0
  8. CVE-2026-54040LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass5.9
  9. CVE-2026-54036LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification5.3
  10. CVE-2026-44654LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents8.1
  11. CVE-2026-44653LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets6.5
  12. CVE-2026-32625LibreChat Exfiltrates Server Secrets via MCP Server URL Injection9.6
  13. CVE-2026-31942LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys7.1
  14. CVE-2026-34371LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal6.3
  15. CVE-2026-31951LibreChat's MCP Server Header Injection Enables OAuth Token Theft6.8

The record

Peak rank
#88 in Jun 2026
Busiest month shown
Jun 2026, 13 CVEs
Months with a KEV entry
0 since Mar 2025
Monthly snapshots
3 since 2025
Danny-avila's full record, month by month