Login Request a demo
LA
Vendor
langchain-ai
21 products with CVEs on record
49
CVEs
0
On KEV
7
New 30D
Products
LA
langchainjs
langchain-ai
9.1
5 CVEs0 on KEV2 new
LA
langgraph
langchain-ai
7.8
10 CVEs0 on KEV3 new
LA
langgraph-checkpoint-postgres
langchain-ai
6.0
2 CVEs0 on KEV1 new
LA
langgraph-checkpoint-sqlite
langchain-ai
6.0
2 CVEs0 on KEV1 new
LA
langchain
langchain-ai
8.3
8 CVEs0 on KEV0 new
LA
langsmith-sdk
langchain-ai
9.8
5 CVEs0 on KEV0 new
LA
langgraph-api
langchain-ai
5.9
2 CVEs0 on KEV0 new
LA
langgraphjs
langchain-ai
6.7
2 CVEs0 on KEV0 new
HE
helm
langchain-ai
8.1
1 CVEs0 on KEV0 new
LA
langchain-ai
langchain-ai
9.1
1 CVEs0 on KEV0 new
LA
langchain-ai/langchain
langchain-ai
7.3
1 CVEs0 on KEV0 new
LA
langchain-anthropic
langchain-ai
5.5
1 CVEs0 on KEV0 new
LA
langchain-community
langchain-ai
8.6
1 CVEs0 on KEV0 new
LA
langchain-mongodb
langchain-ai
7.7
1 CVEs0 on KEV0 new
LA
langchain-openai
langchain-ai
3.1
1 CVEs0 on KEV0 new
LA
langchain-sdk
langchain-ai
9.1
1 CVEs0 on KEV0 new
LA
langchain-text-splitters
langchain-ai
6.5
1 CVEs0 on KEV0 new
LA
langgraph-checkpoint
langchain-ai
6.6
1 CVEs0 on KEV0 new
LA
langgraph-checkpoint-mongodb
langchain-ai
7.7
1 CVEs0 on KEV0 new
LA
langgraph-store-mongodb
langchain-ai
7.7
1 CVEs0 on KEV0 new
LA
langraph-checkpoint
langchain-ai
6.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115885
New
LA
langgraph
langchain-ai
4.1
0%
Oct 23LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
CVE-2026-115883
New
LA
langgraph
langchain-ai
6.0
0%
Oct 23LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
CVE-2026-106119
LA
langchainjs
langchain-ai
6.0
0%
Oct 6LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
CVE-2026-105799
LA
langchainjs
langchain-ai
2.3
0%
Oct 6LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
CVE-2026-104873
LA
langgraph
langchain-ai
7.6
0%
Oct 2LangGraph SDK custom auth silently ignores actions= on resource decorators
CVE-2026-55253
LA
langgraph-store-mongodb
langchain-ai
7.7
1%
Sep 14LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
CVE-2026-55235
LA
langgraph-api
langchain-ai
5.9
0%
Sep 14langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
CVE-2026-55236
LA
langgraph-api
langchain-ai
5.9
0%
Sep 14langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
CVE-2026-72848
LA
langchain-community
langchain-ai
8.6
1%
Aug 20langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery
CVE-2026-71433
LA
langgraph
langchain-ai
5.3
0%
Aug 6LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
CVE-2026-48121
LA
langgraphjs
langchain-ai
6.7
0%
Aug 4@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
CVE-2026-59152
LA
langsmith-sdk
langchain-ai
5.0
0%
Jul 6Arbitrary server-side file read in LangSmith SDK TracingMiddleware
CVE-2026-14742
LA
langgraph
langchain-ai
3.1
0%
Jul 5langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
CVE-2026-55443
LA
langchain
langchain-ai
5.5
0%
Jun 22LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
CVE-2026-48776
LA
langchain-sdk
langchain-ai
9.1
0%
Jun 16LangGraph SDK has unsafe URL path construction
CVE-2026-48775
LA
langraph-checkpoint
langchain-ai
6.8
0%
Jun 16LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading
CVE-2026-45134
LA
langsmith-sdk
langchain-ai
7.1
0%
May 27LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
CVE-2026-44843
LA
langchain
langchain-ai
8.2
0%
May 26LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
CVE-2026-41488
LA
langchain-openai
langchain-ai
3.1
0%
Apr 24angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
CVE-2026-41481
LA
langchain-text-splitters
langchain-ai
6.5
0%
Apr 24LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
CVE-2026-41182
LA
langsmith-sdk
langchain-ai
5.3
0%
Apr 23LangSmith SDK: Streaming token events bypass output redaction
CVE-2026-40190
LA
langsmith-sdk
langchain-ai
9.8
0%
Apr 10LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
CVE-2026-40087
LA
langchain
langchain-ai
5.3
0%
Apr 9LangChain has incomplete f-string validation in prompt templates
CVE-2026-34070
LA
langchain
langchain-ai
7.5
1%
Mar 31LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
CVE-2026-28277
LA
langgraph
langchain-ai
7.2
5%
Mar 5LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading
CVE-2026-25750
HE
helm
langchain-ai
8.1
0%
Mar 4LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl
CVE-2026-27795
LA
langchainjs
langchain-ai
7.4
0%
Feb 25LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
CVE-2026-27794
LA
langgraph-checkpoint
langchain-ai
6.6
1%
Feb 25LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution
CVE-2026-27022
LA
langgraphjs
langchain-ai
6.5
4%
Feb 20RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
CVE-2026-26019
LA
langchainjs
langchain-ai
4.1
0%
Feb 11@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
CVE-2026-26013
LA
langchain
langchain-ai
3.7
0%
Feb 10LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
CVE-2026-25528
LA
langsmith-sdk
langchain-ai
5.8
0%
Feb 9LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
CVE-2024-58340
LA
LangChain
LangChain AI
7.5
0%
Jan 12LangChain <= 0.3.1 MRKLOutputParser ReDoS
CVE-2025-68665
LA
langchainjs
langchain-ai
9.1
1%
Dec 23LangChain serialization injection vulnerability enables secret extraction
CVE-2025-68664
LA
langchain
langchain-ai
8.2
43%
Dec 23LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
CVE-2025-67644
LA
langgraph
langchain-ai
7.8
2%
Dec 10LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
CVE-2025-65106
LA
langchain
langchain-ai
8.3
1%
Nov 21LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
CVE-2025-64439
LA
langgraph
langchain-ai
7.4
1%
Nov 7LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
CVE-2025-64104
LA
langgraph
langchain-ai
7.3
0%
Oct 29LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore
CVE-2025-8709
LA
langchain-ai/langchain
langchain-ai
7.3
0%
Oct 26SQL Injection in langchain-ai/langchain