All 6 CVE vulnerabilities found in LangBot, with AI-generated Chinese analysis, references, and POCs.
Vendor: langbot-app
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-112265 | LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification CWE-345 | 6.5 | Medium | 2026-10-19 |
| CVE-2026-90938 | LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket CWE-306 | 8.6 | High | 2026-09-14 |
| CVE-2026-90562 | LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key CWE-331 | 8.1 | High | 2026-09-13 |
| CVE-2026-54449 | LangBot: Authenticated RCE Via MCP Configuration CWE-77 | 8.8 | High | 2026-08-20 |
| CVE-2026-28509 | LangBot has a Cross Site Scripting(XSS) Vulnerability CWE-79 | 6.3 | Medium | 2026-03-06 |
| CVE-2025-59835 | LangBot has a cross-directory file upload vulnerability, which could lead to system takeover CWE-23 | 8.8AI | High AI | 2025-10-02 |
All 6 known CVE vulnerabilities affecting LangBot with full Chinese analysis, references, and POCs where available.