[{"data":1,"prerenderedAt":635},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-4166":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":41,"summary":60,"kind":75,"entity":76,"evidence":114,"related":122},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-08-13T03:22:54.231Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-08-13T03:21:22.165Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":30,"parseErrorCount":32,"unsupportedFileCount":37,"evaluatedVersionCount":38,"metadataResolvedCount":39,"metadataNotFoundCount":40,"osvEvaluatedVersionCount":38,"codeRadarRepositoryCount":30},31,30,1,18,4,21,32,0,3642,3632,10,{"componentParserSchemaVersion":42,"candidateBoundary":43,"resolvedVersionBoundary":44,"manifestRangesResolved":45,"latestVersionSubstitution":45,"containerTagsVulnerabilityChecked":45,"osvClaim":46,"depsDevLicenseSemantics":47,"providerSemantics":48,"generativeAiUsed":45,"scoreUsed":45,"treeEntryCeiling":49,"fileByteCeiling":50,"uniqueVersionCeiling":51,"observedFormats":52},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[53,54,55,56,57,58,59],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":61,"aiPackageCount":62,"resolvedComponentCount":63,"resolvedVersionCount":38,"providerExposureRepositoryCount":64,"licenseExpressionCount":65,"knownLicensePackageCount":66,"unknownLicensePackageCount":31,"advisoryCount":67,"matchedAdvisoryRepositoryCount":68,"topPackage":69},2274,44,5994,6,53,2244,640,26,{"id":70,"slug":71,"label":72,"repositoryCount":73,"repositoryShare":74},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",19,0.6129032258064516,"repository",{"id":77,"slug":78,"gitlabProjectId":79,"name":80,"pathWithNamespace":81,"description":82,"webUrl":83,"commitSha":84,"commitUrl":85,"lastActivityAt":86,"headCommittedAt":87,"tree":88,"files":91,"resolvedComponentCount":92,"artifactResolvedComponentCount":37,"exactManifestPinCount":92,"packageCount":92,"ecosystems":93,"aiPackageCount":92,"licenseExpressionCount":32,"unknownLicensePackageCount":37,"advisoryIds":95,"advisoryCount":112,"providers":113},"opencode:4166","opencode-4166",4166,"ai-legal-graph","iorb\u002Fai-legal-graph",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fiorb\u002Fai-legal-graph","8c26aa4fed1fcb1be4ecfbbf745144dbf812e4be","https:\u002F\u002Fgitlab.opencode.de\u002Fiorb\u002Fai-legal-graph\u002F-\u002Fcommit\u002F8c26aa4fed1fcb1be4ecfbbf745144dbf812e4be","2025-04-10T15:29:54.353Z","2025-03-31T12:14:45.000Z",{"complete":89,"entryCount":90,"truncated":45},true,234,[],8,[94],"pypi",[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111],"GHSA-2g6r-c272-w58r","GHSA-3644-q5cj-c5c7","GHSA-45pg-36p6-83v9","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-g48c-2wqr-h844","GHSA-gr75-jv2w-4656","GHSA-pc6w-59fv-rh23","GHSA-pjwx-r37v-7724","GHSA-q25c-c977-4cmh","GHSA-qh6h-p6c9-ff54","GHSA-w39p-vh2g-g8g5","PYSEC-2024-115","PYSEC-2024-323",16,[],{"files":115,"occurrenceCount":92},[116],{"path":117,"kind":118,"sourceUrl":119,"commitSha":84,"blobSha":120,"state":121,"componentCount":92},"requirements.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Fiorb\u002Fai-legal-graph\u002F-\u002Fblob\u002F8c26aa4fed1fcb1be4ecfbbf745144dbf812e4be\u002Frequirements.txt","eb8e9a474c655bc81e1a5841cf757dec75775529","parsed",{"packages":123,"vulnerabilities":198},[124,135,144,153,163,172,181,190],{"id":125,"slug":126,"identity":127,"label":128,"aiRelevant":89,"provider":82,"advisoryCount":129,"licenseExpressions":130,"versions":132,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":134},"package:pypi:langchain-core","langchain-core-82117efb","pypi:langchain-core","LangChain Core",7,[131],"MIT",[133],"0.2.28",[117],{"id":136,"slug":137,"identity":138,"label":139,"aiRelevant":89,"provider":82,"advisoryCount":34,"licenseExpressions":140,"versions":141,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":143},"package:pypi:langchain-community","langchain-community-b296254c","pypi:langchain-community","LangChain Community",[131],[142],"0.2.7",[117],{"id":145,"slug":146,"identity":147,"label":148,"aiRelevant":89,"provider":82,"advisoryCount":149,"licenseExpressions":150,"versions":151,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":152},"package:pypi:langchain","langchain-2b3b6a0b","pypi:langchain","LangChain",3,[131],[142],[117],{"id":154,"slug":155,"identity":156,"label":157,"aiRelevant":89,"provider":82,"advisoryCount":158,"licenseExpressions":159,"versions":160,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":162},"package:pypi:langgraph","langgraph-6c1c645e","pypi:langgraph","LangGraph",2,[131],[161],"0.1.1",[117],{"id":164,"slug":165,"identity":166,"label":167,"aiRelevant":89,"provider":82,"advisoryCount":37,"licenseExpressions":168,"versions":169,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":171},"package:pypi:langchain-experimental","langchain-experimental-7a9ed002","pypi:langchain-experimental","LangChain · Experimental",[131],[170],"0.0.63",[117],{"id":173,"slug":174,"identity":175,"label":176,"aiRelevant":89,"provider":82,"advisoryCount":37,"licenseExpressions":177,"versions":178,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":180},"package:pypi:langchain-groq","langchain-groq-aed894e4","pypi:langchain-groq","LangChain · Groq",[131],[179],"0.1.5",[117],{"id":182,"slug":183,"identity":184,"label":185,"aiRelevant":89,"provider":82,"advisoryCount":37,"licenseExpressions":186,"versions":187,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":189},"package:pypi:langchain-huggingface","langchain-huggingface-89b06dab","pypi:langchain-huggingface","LangChain · Hugging Face",[131],[188],"0.0.3",[117],{"id":191,"slug":192,"identity":193,"label":194,"aiRelevant":89,"provider":82,"advisoryCount":37,"licenseExpressions":195,"versions":196,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":32,"evidenceFiles":197},"package:pypi:langchain-ollama","langchain-ollama-c606221f","pypi:langchain-ollama","LangChain · Ollama",[131],[161],[117],[199,233,267,296,324,350,384,418,445,471,500,522,550,585,618],{"id":96,"slug":200,"dossier":45,"summary":201,"aliases":202,"sourceIds":205,"published":206,"modified":207,"checkedAt":7,"severity":208,"references":212,"versionKeys":230,"packageCount":32,"repositoryCount":158},"ghsa-2g6r-c272-w58r-4bbbcb01","LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages",[203,204],"CVE-2026-26013","PYSEC-2026-2562",[96,204],"2026-02-11T14:23:13Z","2026-07-13T16:43:30.756724986Z",[209],{"type":210,"score":211},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[213,216,219,221,224,226,228],{"type":214,"url":215},"WEB","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",{"type":217,"url":218},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26013",{"type":214,"url":220},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F2b4b1dc29a833d4053deba4c2b77a3848c834565",{"type":222,"url":223},"PACKAGE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain",{"type":214,"url":225},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.11",{"type":222,"url":227},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-core",{"type":217,"url":229},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",[231,232],"pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7",{"id":97,"slug":234,"dossier":45,"summary":235,"aliases":236,"sourceIds":241,"published":242,"modified":243,"checkedAt":7,"severity":244,"references":247,"versionKeys":262,"packageCount":149,"repositoryCount":149},"ghsa-3644-q5cj-c5c7-4c578cf2","LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",[237,238,239,240],"CVE-2026-45134","PYSEC-2026-2555","PYSEC-2026-2560","PYSEC-2026-2582",[97,238,239,240],"2026-05-13T15:29:30Z","2026-07-13T16:43:39.736848907Z",[245],{"type":210,"score":246},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[248,250,252,254,256,258,260],{"type":214,"url":249},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":217,"url":251},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45134",{"type":222,"url":253},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk",{"type":222,"url":255},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain",{"type":217,"url":257},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":222,"url":259},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-classic",{"type":222,"url":261},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangsmith",[263,264,265,266],"pypi:langchain-classic@1.0.1","pypi:langchain@0.2.7","pypi:langchain@0.3.7","pypi:langsmith@0.6.4",{"id":98,"slug":268,"dossier":45,"summary":269,"aliases":270,"sourceIds":273,"published":274,"modified":275,"checkedAt":7,"severity":276,"references":282,"versionKeys":294,"packageCount":32,"repositoryCount":32},"ghsa-45pg-36p6-83v9-9505da12","Langchain SQL Injection vulnerability",[271,110,272],"CVE-2024-8309","PYSEC-2026-1507",[98],"2024-10-29T15:32:05Z","2026-07-07T17:57:12.591755527Z",[277,279],{"type":210,"score":278},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":280,"score":281},"CVSS_V4","CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[283,285,287,289,290,292],{"type":217,"url":284},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-8309",{"type":214,"url":286},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F64c317eba05fbac0c6a6fc5aa192bc0d7130972e",{"type":214,"url":288},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc2a3021bb0c5f54649d380b42a0684ca5778c255",{"type":222,"url":223},{"type":214,"url":291},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flangchain\u002FPYSEC-2024-115.yaml",{"type":214,"url":293},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5",[295],"pypi:langchain-community@0.2.7",{"id":99,"slug":297,"dossier":45,"summary":298,"aliases":299,"sourceIds":302,"published":303,"modified":304,"checkedAt":7,"severity":305,"references":308,"versionKeys":323,"packageCount":32,"repositoryCount":32},"ghsa-5chr-fjjv-38qv-5f3dd755","langchain-core allows unauthorized users to read arbitrary files from the host file system",[300,301],"CVE-2024-10940","PYSEC-2026-1517",[99,301],"2025-03-20T12:32:41Z","2026-07-07T17:56:35.905913395Z",[306],{"type":210,"score":307},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[309,311,313,315,317,318,320,321],{"type":217,"url":310},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-10940",{"type":214,"url":312},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F7d481f10102f43559cc57bcad7eba291067939ee",{"type":214,"url":314},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc1e742347f9701aadba8920e4d1f79a636e50b68",{"type":214,"url":316},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fe711034713259ae448981bc0fd1d7a5671499c31",{"type":222,"url":223},{"type":214,"url":319},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fbe1ee1cb-2147-4ff4-a57b-b6045271cf27",{"type":222,"url":227},{"type":217,"url":322},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5chr-fjjv-38qv",[231],{"id":100,"slug":325,"dossier":45,"summary":326,"aliases":327,"sourceIds":330,"published":331,"modified":332,"checkedAt":7,"severity":333,"references":336,"versionKeys":349,"packageCount":32,"repositoryCount":32},"ghsa-6qv9-48xg-fc7f-6f0bc426","LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",[328,329],"CVE-2025-65106","PYSEC-2026-1518",[100,329],"2025-11-20T17:42:12Z","2026-07-07T17:57:16.939269197Z",[334],{"type":280,"score":335},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[337,339,341,343,345,346,347],{"type":214,"url":338},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",{"type":217,"url":340},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-65106",{"type":214,"url":342},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc4b6ba254e1a49ed91f2e268e6484011c540542a",{"type":214,"url":344},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Ffa7789d6c21222b85211755d822ef698d3b34e00",{"type":222,"url":223},{"type":222,"url":227},{"type":217,"url":348},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",[231],{"id":101,"slug":351,"dossier":45,"summary":352,"aliases":353,"sourceIds":356,"published":357,"modified":358,"checkedAt":7,"severity":359,"references":362,"versionKeys":383,"packageCount":32,"repositoryCount":158},"ghsa-926x-3r5x-gfhw-b7d12e65","LangChain has incomplete f-string validation in prompt templates",[354,355],"CVE-2026-40087","PYSEC-2026-2563",[101,355],"2026-04-08T21:51:32Z","2026-07-13T16:42:42.901211235Z",[360],{"type":210,"score":361},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[363,365,367,369,371,373,375,376,378,380,381],{"type":214,"url":364},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",{"type":217,"url":366},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40087",{"type":214,"url":368},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36612",{"type":214,"url":370},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36613",{"type":214,"url":372},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F6bab0ba3c12328008ddca3e0d54ff5a6151cd27b",{"type":214,"url":374},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Faf2ed47c6f008cdd551f3c0d87db3774c8dfe258",{"type":222,"url":223},{"type":214,"url":377},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.84",{"type":214,"url":379},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.28",{"type":222,"url":227},{"type":217,"url":382},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",[231,232],{"id":102,"slug":385,"dossier":45,"summary":386,"aliases":387,"sourceIds":390,"published":391,"modified":392,"checkedAt":7,"severity":393,"references":396,"versionKeys":417,"packageCount":32,"repositoryCount":32},"ghsa-c67j-w6g6-q2cm-a4c5c0cf","LangChain serialization injection vulnerability enables secret extraction in dumps\u002Floads APIs",[388,389],"CVE-2025-68664","PYSEC-2026-373",[102,389],"2025-12-23T18:46:13Z","2026-07-02T13:00:05.018724776Z",[394],{"type":210,"score":395},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:L\u002FA:N",[397,399,401,403,405,407,409,410,412,414,415],{"type":214,"url":398},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",{"type":217,"url":400},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68664",{"type":214,"url":402},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34455",{"type":214,"url":404},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34458",{"type":214,"url":406},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8",{"type":214,"url":408},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fd9ec4c5cc78960abd37da79b0250f5642e6f0ce6",{"type":222,"url":223},{"type":214,"url":411},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.81",{"type":214,"url":413},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.5",{"type":222,"url":227},{"type":217,"url":416},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",[231],{"id":103,"slug":419,"dossier":45,"summary":420,"aliases":421,"sourceIds":424,"published":425,"modified":426,"checkedAt":7,"severity":427,"references":432,"versionKeys":441,"packageCount":32,"repositoryCount":149},"ghsa-g48c-2wqr-h844-48f35247","LangGraph checkpoint loading has unsafe msgpack deserialization",[422,423],"CVE-2026-28277","PYSEC-2026-83",[103,423],"2026-03-05T20:16:15.677Z","2026-06-06T01:00:08.116125988Z",[428,430],{"type":210,"score":429},"CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":210,"score":431},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[433,435,437,439],{"type":217,"url":434},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-g48c-2wqr-h844",{"type":217,"url":436},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28277",{"type":222,"url":438},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph",{"type":214,"url":440},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-83.yaml",[442,443,444],"pypi:langgraph@0.1.1","pypi:langgraph@0.3.21","pypi:langgraph@1.0.6",{"id":104,"slug":446,"dossier":45,"summary":447,"aliases":448,"sourceIds":452,"published":453,"modified":454,"checkedAt":7,"severity":455,"references":460,"versionKeys":469,"packageCount":32,"repositoryCount":149},"ghsa-gr75-jv2w-4656-a5b8c61e","LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",[449,450,451],"CVE-2026-55443","PYSEC-2026-2192","PYSEC-2026-2556",[104,450],"2026-06-16T15:03:14Z","2026-08-07T08:11:57.170704540Z",[456,458],{"type":210,"score":457},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":210,"score":459},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[461,463,465,468],{"type":217,"url":462},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-gr75-jv2w-4656",{"type":217,"url":464},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55443",{"type":466,"url":467},"FIX","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fdcaf7795a3e6590af55c3ff7bda6add6355e9ea6",{"type":222,"url":223},[264,265,470],"pypi:langchain@1.2.6",{"id":105,"slug":472,"dossier":45,"summary":473,"aliases":474,"sourceIds":477,"published":478,"modified":479,"checkedAt":7,"severity":480,"references":483,"versionKeys":498,"packageCount":32,"repositoryCount":158},"ghsa-pc6w-59fv-rh23-cab9cb2f","Langchain Community Vulnerable to XML External Entity (XXE) Attacks",[475,476],"CVE-2025-6984","PYSEC-2026-1515",[105,476],"2025-09-04T12:30:42Z","2026-07-07T17:56:45.822570559Z",[481],{"type":210,"score":482},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[484,486,488,490,492,494,496],{"type":217,"url":485},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6984",{"type":214,"url":487},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain-community\u002Fcommit\u002Fe842452108089524e22c3a2ced851c021884556f",{"type":222,"url":489},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain-community",{"type":214,"url":491},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fblob\u002Fd79b5813a0b3b243c612b77013768995e46c4337\u002Flibs\u002Flangchain\u002Flangchain\u002Fdocument_loaders\u002Fevernote.py#L1-L23",{"type":214,"url":493},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fa6b521cf-258c-41c0-9edb-d8ef976abb2a",{"type":222,"url":495},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-community",{"type":217,"url":497},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pc6w-59fv-rh23",[295,499],"pypi:langchain-community@0.3.7",{"id":106,"slug":501,"dossier":45,"summary":502,"aliases":503,"sourceIds":506,"published":507,"modified":508,"checkedAt":7,"severity":509,"references":512,"versionKeys":521,"packageCount":32,"repositoryCount":158},"ghsa-pjwx-r37v-7724-2297a72a","LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists",[504,505],"CVE-2026-44843","PYSEC-2026-2564",[106,505],"2026-05-08T23:07:32Z","2026-07-13T16:42:39.210995356Z",[510],{"type":210,"score":511},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[513,515,517,518,519],{"type":214,"url":514},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",{"type":217,"url":516},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44843",{"type":222,"url":223},{"type":222,"url":227},{"type":217,"url":520},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",[231,232],{"id":107,"slug":523,"dossier":45,"summary":524,"aliases":525,"sourceIds":528,"published":529,"modified":530,"checkedAt":7,"severity":531,"references":534,"versionKeys":549,"packageCount":32,"repositoryCount":32},"ghsa-q25c-c977-4cmh-8e74e348","Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever",[526,527],"CVE-2024-3095","PYSEC-2026-1516",[107,527],"2024-06-06T21:30:36Z","2026-07-07T17:57:27.127785500Z",[532],{"type":210,"score":533},"CVSS:3.0\u002FAV:P\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[535,537,539,541,542,544,546,547],{"type":217,"url":536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-3095",{"type":214,"url":538},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F24451",{"type":214,"url":540},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F604dfe2d99246b0c09f047c604f0c63eafba31e7",{"type":222,"url":223},{"type":214,"url":543},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-community%3D%3D0.2.9",{"type":214,"url":545},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fe62d4895-2901-405b-9559-38276b6a5273",{"type":222,"url":495},{"type":217,"url":548},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q25c-c977-4cmh",[295],{"id":108,"slug":551,"dossier":45,"summary":552,"aliases":553,"sourceIds":556,"published":557,"modified":558,"checkedAt":7,"severity":559,"references":562,"versionKeys":584,"packageCount":32,"repositoryCount":158},"ghsa-qh6h-p6c9-ff54-caf42ff5","LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",[554,555],"CVE-2026-34070","PYSEC-2026-2193",[108,555],"2026-03-27T19:45:00Z","2026-07-13T07:26:33.913236655Z",[560],{"type":210,"score":561},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[563,566,568,570,571,573,575,577,579,581],{"type":564,"url":565},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-qh6h-p6c9-ff54",{"type":217,"url":567},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34070",{"type":466,"url":569},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F27add913474e01e33bededf4096151130ba0d47c",{"type":222,"url":223},{"type":217,"url":572},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core==1.2.22",{"type":214,"url":574},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34070",{"type":214,"url":576},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34070.json",{"type":217,"url":578},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24766",{"type":217,"url":580},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":582,"url":583},"REPORT","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2453287",[231,232],{"id":109,"slug":586,"dossier":45,"summary":587,"aliases":588,"sourceIds":592,"published":593,"modified":594,"checkedAt":7,"severity":595,"references":600,"versionKeys":616,"packageCount":158,"repositoryCount":158},"ghsa-w39p-vh2g-g8g5-47880dfe","LangGraph SDK has unsafe URL path construction",[589,590,591],"CVE-2026-48776","PYSEC-2026-2194","PYSEC-2026-2575",[109,590,591],"2026-06-17T10:55:15.113Z","2026-07-21T15:15:50.659527533Z",[596,598],{"type":210,"score":597},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":210,"score":599},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[601,603,605,607,608,610,612,614],{"type":214,"url":602},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":217,"url":604},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48776",{"type":217,"url":606},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":222,"url":438},{"type":214,"url":609},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Freleases\u002Ftag\u002Fsdk%3D%3D0.3.15",{"type":214,"url":611},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph-sdk\u002FPYSEC-2026-2575.yaml",{"type":214,"url":613},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-2194.yaml",{"type":222,"url":615},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flanggraph-sdk",[617,442],"pypi:langgraph-sdk@0.3.3",{"id":111,"slug":619,"dossier":45,"summary":82,"aliases":620,"sourceIds":624,"published":625,"modified":626,"checkedAt":7,"severity":627,"references":630,"versionKeys":634,"packageCount":32,"repositoryCount":32},"pysec-2024-323-1dd96856",[621,622,623],"CVE-2024-5998","GHSA-f2jm-rw3h-6phg","PYSEC-2026-1514",[111],"2024-09-17T12:15:02.977Z","2026-07-13T07:26:23.643495355Z",[628],{"type":210,"score":629},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[631,632],{"type":466,"url":540},{"type":564,"url":633},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Ffa3a2753-57c3-4e08-a176-d7a3ffda28fe",[264],1786591832199]