Medium
CVE-2024-10940
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 67
Reset filters
Medium
CVE-2024-3095
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
Medium
CVE-2024-3571
langchain vulnerable to path traversal
Medium
CVE-2024-1455
LangChain's XMLOutputParser vulnerable to XML Entity Expansion
High
CVE-2023-32786
Langchain Server-Side Request Forgery vulnerability
Critical
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Critical
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
Medium
CVE-2026-48520
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
Medium
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
High
CVE-2026-45134
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Medium
CVE-2026-41481
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Low
CVE-2026-41488
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
High
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
Medium
CVE-2026-28277
LangGraph checkpoint loading has unsafe msgpack deserialization
Critical
CVE-2026-27966
Langflow has Remote Code Execution in CSV Agent
High
CVE-2024-58340
LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/langchain/langchain/agents/mrkl/output_pa
Critical
CVE-2025-2828
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.Requests
High
CVE-2024-12704
LlamaIndex Improper Handling of Exceptional Conditions vulnerability
Critical
CVE-2024-46946
LangChain Experimental Eval Injection vulnerability
Medium
CVE-2024-5998
LangChain pickle deserialization of untrusted data
Critical
CVE-2024-21513
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' o
High
CVE-2024-38459
langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27
Medium
CVE-2024-2965
Denial of service in langchain-community
High
CVE-2024-37058
MLFlow unsafe deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.