lobehub lobe-chat

• CVE-2026-72594 High 7.6 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload 0.3%
• CVE-2026-23835 Medium 5.7 LobeHub Vulnerable to Improper Authorization in Presigned Upload 0.4%
• CVE-2026-23522 Low 3.7 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion 0.2%
• CVE-2026-23733 Medium 6.4 Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) 0.1%
• CVE-2025-62505 Low 3.0 SSRF in lobehub/lobe-chat with native web fetch module 0.3%
• CVE-2025-59426 Medium 4.3 lobe-chat has an Open Redirect 0.4%
• CVE-2025-59417 Medium 6.8 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages 0.4%
• CVE-2024-32965 High 8.1 ssrf vulnerability in lobe-chat 26.1%
• CVE-2024-47066 Critical 9.0 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) 11.9%
• CVE-2024-37895 Medium 5.7 API Key Leak in lobe-chat 0.5%
• CVE-2024-32964 Critical 9.0 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability 53.0%
• CVE-2024-24566 Medium 5.3 Lobe Chat unauthorized access to plugins 0.5%