Medium
CVE-2026-48775
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 13
Reset filters
High
CVE-2026-44843
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
Medium
CVE-2026-40087
LangChain has incomplete f-string validation in prompt templates
Low
CVE-2026-26013
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
Unrated
pysec-2026-1070
Malicious code in langchain-core-mcp (PyPI)
High
CVE-2025-65106
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
Medium
CVE-2024-10940
langchain-core allows unauthorized users to read arbitrary files from the host file system
Medium
CVE-2024-1455
LangChain's XMLOutputParser vulnerable to XML Entity Expansion
Critical
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Medium
CVE-2026-41481
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Low
CVE-2026-41488
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
High
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
Low
CVE-2024-28088
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading con
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.