Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

lobehub — Vulnerabilities & Security Advisories 21

Browse all 21 CVE security advisories affecting lobehub. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Lobehub develops wireless communication devices primarily for business conferencing and remote collaboration solutions. Historically, the devices have been vulnerable to multiple security issues including remote code execution, cross-site scripting, and privilege escalation vulnerabilities. These flaws often stem from improper input validation, insecure authentication mechanisms, and firmware weaknesses. While no major public security incidents have been widely reported, the 12 documented CVEs indicate a pattern of security concerns that could potentially allow unauthorized access or system compromise. Organizations using these devices should implement network segmentation and ensure timely firmware updates to mitigate potential risks.

Top products by lobehub: lobe-chat lobehub
CVE ID Title CVSS Severity Published
CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu — lobehub CWE-345 6.5 Medium 2026-09-04
CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload — lobe-chat CWE-79 7.6 High 2026-08-10
CVE-2026-59100 LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations — lobehub CWE-639 5.0 Medium 2026-07-02
CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search — lobehub CWE-639 6.5 Medium 2026-07-02
CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl — lobehub CWE-918 7.7 High 2026-07-02
CVE-2026-58580 LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes — lobehub CWE-639 5.9 Medium 2026-07-02
CVE-2026-58578 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import — lobehub CWE-1333 6.5 Medium 2026-07-02
CVE-2026-54157 LobeHub: Unauthenticated SSRF in `/webapi/proxy` — lobehub CWE-918 9.0 Critical 2026-06-23
CVE-2026-42045 LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) — lobehub CWE-79 6.2 Medium 2026-05-12
CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header — lobehub CWE-287 5.0 Medium 2026-04-08
CVE-2026-23835 LobeHub Vulnerable to Improper Authorization in Presigned Upload — lobe-chat CWE-73 6.5AI Medium AI 2026-01-30
CVE-2026-23522 Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion — lobe-chat CWE-284 3.7 Low 2026-01-19
CVE-2026-23733 Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) — lobe-chat CWE-94 6.4 Medium 2026-01-18
CVE-2025-62505 SSRF in lobehub/lobe-chat with native web fetch module — lobe-chat CWE-918 3.0 Low 2025-10-17
CVE-2025-59426 lobe-chat has an Open Redirect — lobe-chat CWE-601 4.3 Medium 2025-09-25
CVE-2025-59417 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages — lobe-chat CWE-79 8.2AI High AI 2025-09-18
CVE-2024-32965 ssrf vulnerability in lobe-chat — lobe-chat CWE-918 8.1 High 2024-11-26
CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) — lobe-chat CWE-918 9.0 Critical 2024-09-23
CVE-2024-37895 API Key Leak in lobe-chat — lobe-chat CWE-200 5.7 Medium 2024-06-17
CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability — lobe-chat CWE-918 9.0 Critical 2024-05-10
CVE-2024-24566 Lobe Chat unauthorized access to plugins — lobe-chat CWE-284 5.3 Medium 2024-01-31

This page lists every published CVE security advisory associated with lobehub. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.