3
CVEs
0
Critical
0
High
0
KEV
3
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85702 | Unauthenticated access to the Backend Conversation API in ramon-victor/freegpt-webui allows remote attackers to invoke the `_conversation` function without valid credentials by manipulating the `model` argument in HTTP requests to `server/backend.py`. The affected codebase is a rolling-release hobby project that has been abandoned by its maintainer, meaning no patch will be issued. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation against any instance still running. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-85701 | Missing authentication in freegpt-webui's ChatCompletion.create function (g4f/__init__.py, up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) permits unauthenticated remote callers to invoke AI chat completion requests directly against the backend providers without credentials. A public proof-of-concept is available on GitHub. The product is abandoned and no longer maintained, meaning no vendor patch will be issued, and remediation requires decommissioning or layered compensating controls. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-85703 | Unthrottled resource allocation in freegpt-webui's getJailbreak function (server/backend.py) enables remote unauthenticated attackers to exhaust server resources via crafted Jailbreak Mode requests (CWE-770). The affected product is an unmaintained hobby GPT wrapper by ramon-victor, pinned to all commits through 098db3dfeb41555c2ca9269df0f13e10ec1c35dc with no patched release forthcoming. A public proof-of-concept exploit is available on GitHub, and no vendor fix will be issued as the maintainer has abandoned the project. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|