1
CVEs
1
Critical
0
High
0
KEV
0
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-68929 | Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|