https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:17:50.871401+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330370 EUVD-2026-330370 2026-10-06T03:17:50.903138+00:00 EUVD-2026-330370 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54037 fkie_cve-2026-54037 2026-10-06T03:17:50.903172+00:00

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint — which is in the same file and performs the exact same expensive database operations — was not given any rate limiter. An authenticated user can bypass the CVE-2025-7105 fix by using /duplicate instead of /fork to exhaust server resources. This vulnerability is fixed in 0.8.4-rc1.