Advisories · Technology
lobehub.
Every CVE that names lobehub among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu
- lobehub
- CWE-345
- CVSS 2.3 Low
LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations
- lobehub
- Broken access control
- CVSS 7.1 High
LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search
- lobehub
- Broken access control
- CVSS 8.3 High
LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
- lobehub
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes
- lobehub
- Broken access control
- CVSS 7.1 High
LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import
- lobehub
- Denial of service