Lobe Chat
Filed as: lobe-chat, @lobehub/chat, LobeChat, LobeHub
Newest record 2026-02-01 · 11 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Exploited or KEV-listed · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for Lobe Chat has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
Disclosed CVEs, no confirmed exploitation · 11
- closed5.7Lobe Chat CVE-2026-23835: LobeHub improper authorization in presigned upload
Disclosed · since 1 Feb 2026 · CVE-2026-23835
AI - closed3.7Lobe Chat CVE-2026-23522: Lobe Chat IDOR Vulnerability in Knowledge Base File Removal
Disclosed · since 20 Jan 2026 · CVE-2026-23522
AI - closed9.6Lobe Chat CVE-2026-23733: Lobe Chat Cross-Site Scripting via Mermaid Artifact Renderer
Disclosed · since 20 Jan 2026 · CVE-2026-23733
AI - closed3.0Lobe Chat CVE-2025-62505: Lobe Chat Server-Side Request Forgery
Disclosed · since 17 Oct 2025 · CVE-2025-62505
AI - closed4.3Lobe Chat CVE-2025-59426: Lobe-chat vulnerable to Open Redirect in OIDC handling
Disclosed · since 24 Sep 2025 · CVE-2025-59426
AI - closed6.8Lobe Chat CVE-2025-59417: Lobe Chat Desktop RCE via XSS in Chat Messages
Disclosed · since 18 Sep 2025 · CVE-2025-59417
AI - closed8.1Lobe Chat CVE-2024-32965: LobeChat server side request forgery vulnerability
Disclosed · since 26 Nov 2024 · CVE-2024-32965
AI - closed9.0Lobe Chat CVE-2024-47066: Lobe-chat SSRF protection bypass vulnerability
Disclosed · since 23 Sep 2024 · CVE-2024-47066
AI - closed5.7Lobe Chat CVE-2024-37895: Lobe Chat API key leak vulnerability
Disclosed · since 17 Jun 2024 · CVE-2024-37895
AI - closed9.0Lobe Chat CVE-2024-32964: Lobe-chat unauthorized SSRF vulnerability in proxy API
Disclosed · since 10 May 2024 · CVE-2024-32964
AI - closed5.3Lobe Chat CVE-2024-24566: Lobe Chat Vulnerable to Unauthorized Access to Plugins
Disclosed · since 31 Jan 2024 · CVE-2024-24566
AI
Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.