https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:02:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-361331 EUVD-2026-361331 https://cve.radiocsirt.org/vuln/euvd-2026-361331 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68929 <p>FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated attacker who knows a victim team&#39;s shareId can take that team&#39;s WeChat bot offline or hijack the channel to their own bot: the logout endpoint is gated only by an existence check yet wipes the outLink&#39;s stored WeChat token, and the QR-code status endpoint performs no authorization at all and writes attacker-supplied bot credentials into the outLink identified by shareId. By generating a QR for a victim shareId, scanning it with their own WeChat, and calling the status endpoint, an attacker binds the victim team&#39;s app to the attacker&#39;s bot, exposing the app&#39;s private responses, displacing the legitimate binding, and consuming the victim&#39;s resources. The shareId is exposed in every shared chat URL, iframe, and embed, so it is not a secret. This issue is fixed in version 4.15.2.</p> <p>FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated attacker who knows a victim team&#39;s shareId can take that team&#39;s WeChat bot offline or hijack the channel to their own bot: the logout endpoint is gated only by an existence check yet wipes the outLink&#39;s stored WeChat token, and the QR-code status endpoint performs no authorization at all and writes attacker-supplied bot credentials into the outLink identified by shareId. By generating a QR for a victim shareId, scanning it with their own WeChat, and calling the status endpoint, an attacker binds the victim team&#39;s app to the attacker&#39;s bot, exposing the app&#39;s private responses, displacing the legitimate binding, and consuming the victim&#39;s resources. The shareId is exposed in every shared chat URL, iframe, and embed, so it is not a secret. This issue is fixed in version 4.15.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68929