[{"data":1,"prerenderedAt":600},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-5711":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":41,"summary":60,"kind":75,"entity":76,"evidence":112,"related":124},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-08-13T02:29:21.454Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-08-13T02:28:06.466Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":30,"parseErrorCount":32,"unsupportedFileCount":37,"evaluatedVersionCount":38,"metadataResolvedCount":39,"metadataNotFoundCount":40,"osvEvaluatedVersionCount":38,"codeRadarRepositoryCount":30},31,30,1,18,4,21,32,0,3642,3632,10,{"componentParserSchemaVersion":42,"candidateBoundary":43,"resolvedVersionBoundary":44,"manifestRangesResolved":45,"latestVersionSubstitution":45,"containerTagsVulnerabilityChecked":45,"osvClaim":46,"depsDevLicenseSemantics":47,"providerSemantics":48,"generativeAiUsed":45,"scoreUsed":45,"treeEntryCeiling":49,"fileByteCeiling":50,"uniqueVersionCeiling":51,"observedFormats":52},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[53,54,55,56,57,58,59],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":61,"aiPackageCount":62,"resolvedComponentCount":63,"resolvedVersionCount":38,"providerExposureRepositoryCount":64,"licenseExpressionCount":65,"knownLicensePackageCount":66,"unknownLicensePackageCount":31,"advisoryCount":67,"matchedAdvisoryRepositoryCount":68,"topPackage":69},2274,44,5994,6,53,2244,640,26,{"id":70,"slug":71,"label":72,"repositoryCount":73,"repositoryShare":74},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",19,0.6129032258064516,"repository",{"id":77,"slug":78,"gitlabProjectId":79,"name":80,"pathWithNamespace":81,"description":82,"webUrl":83,"commitSha":84,"commitUrl":85,"lastActivityAt":86,"headCommittedAt":87,"tree":88,"files":91,"resolvedComponentCount":92,"artifactResolvedComponentCount":37,"exactManifestPinCount":92,"packageCount":40,"ecosystems":93,"aiPackageCount":40,"licenseExpressionCount":95,"unknownLicensePackageCount":37,"advisoryIds":96,"advisoryCount":110,"providers":111},"opencode:5711","opencode-5711",5711,"Chat","f13\u002Fmicroservices\u002Fchat","Chat-Microservice mit lokal deployten oder extern verfügbaren Sprachmodellen","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat","80a91b641aa350678c5e35c31e90ffbb9e696d3c","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fcommit\u002F80a91b641aa350678c5e35c31e90ffbb9e696d3c","2026-08-12T09:47:46.270Z","2026-08-11T11:28:47.000Z",{"complete":89,"entryCount":90,"truncated":45},true,133,[],20,[94],"pypi",3,[97,98,99,100,101,102,103,104,105,106,107,108,109],"GHSA-2g6r-c272-w58r","GHSA-3644-q5cj-c5c7","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-g48c-2wqr-h844","GHSA-gr75-jv2w-4656","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","GHSA-r7w7-9xr2-qq2r","GHSA-w39p-vh2g-g8g5","PYSEC-2024-323",13,[],{"files":113,"occurrenceCount":92},[114,120],{"path":115,"kind":116,"sourceUrl":117,"commitSha":84,"blobSha":118,"state":119,"componentCount":40},"requirements-dev.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fblob\u002F80a91b641aa350678c5e35c31e90ffbb9e696d3c\u002Frequirements-dev.txt","55d24b0ef7928f118b1abca940e9921a2650f62b","parsed",{"path":121,"kind":116,"sourceUrl":122,"commitSha":84,"blobSha":123,"state":119,"componentCount":40},"requirements.txt","https:\u002F\u002Fgitlab.opencode.de\u002Ff13\u002Fmicroservices\u002Fchat\u002F-\u002Fblob\u002F80a91b641aa350678c5e35c31e90ffbb9e696d3c\u002Frequirements.txt","2dfd8d16ab95eb8d2065f80c3730c69a9dca6637",{"packages":125,"vulnerabilities":223},[126,139,148,157,169,177,186,195,204,213],{"id":127,"slug":128,"identity":129,"label":130,"aiRelevant":89,"provider":131,"advisoryCount":132,"licenseExpressions":133,"versions":135,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":138},"package:pypi:langchain-core","langchain-core-82117efb","pypi:langchain-core","LangChain Core",null,7,[134],"MIT",[136],"1.5.3",2,[115,121],{"id":140,"slug":141,"identity":142,"label":143,"aiRelevant":89,"provider":131,"advisoryCount":95,"licenseExpressions":144,"versions":145,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":147},"package:pypi:langchain","langchain-2b3b6a0b","pypi:langchain","LangChain",[134],[146],"1.3.14",[115,121],{"id":149,"slug":150,"identity":151,"label":152,"aiRelevant":89,"provider":131,"advisoryCount":137,"licenseExpressions":153,"versions":154,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":156},"package:pypi:langgraph","langgraph-6c1c645e","pypi:langgraph","LangGraph",[134],[155],"1.2.10",[115,121],{"id":158,"slug":159,"identity":160,"label":161,"aiRelevant":89,"provider":162,"advisoryCount":32,"licenseExpressions":165,"versions":166,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":168},"package:pypi:langchain-openai","langchain-openai-4985188e","pypi:langchain-openai","LangChain OpenAI",{"id":163,"label":164},"openai","OpenAI",[134],[167],"1.4.3",[115,121],{"id":70,"slug":71,"identity":170,"label":72,"aiRelevant":89,"provider":171,"advisoryCount":37,"licenseExpressions":172,"versions":174,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":176},"pypi:openai",{"id":163,"label":164},[173],"Apache-2.0",[175],"2.53.0",[115,121],{"id":178,"slug":179,"identity":180,"label":181,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":182,"versions":183,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":185},"package:pypi:langchain-linkup","langchain-linkup-d50e0d4b","pypi:langchain-linkup","LangChain · Linkup",[134],[184],"0.2.1",[115,121],{"id":187,"slug":188,"identity":189,"label":190,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":191,"versions":192,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":194},"package:pypi:langchain-mcp-adapters","langchain-mcp-adapters-1c0e13c7","pypi:langchain-mcp-adapters","LangChain · MCP Adapters",[134],[193],"0.3.2",[115,121],{"id":196,"slug":197,"identity":198,"label":199,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":200,"versions":201,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":203},"package:pypi:langchain-protocol","langchain-protocol-2715aeed","pypi:langchain-protocol","LangChain · Protocol",[134],[202],"0.0.18",[115,121],{"id":205,"slug":206,"identity":207,"label":208,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":209,"versions":210,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":212},"package:pypi:langchain-tavily","langchain-tavily-432e1c93","pypi:langchain-tavily","LangChain · Tavily",[134],[211],"0.2.18",[115,121],{"id":214,"slug":215,"identity":216,"label":217,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":218,"versions":220,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":222},"package:pypi:tiktoken","tiktoken-06b251a3","pypi:tiktoken","tiktoken",[219],"non-standard",[221],"0.13.0",[115,121],[224,258,292,320,347,381,415,442,468,490,525,549,582],{"id":97,"slug":225,"dossier":45,"summary":226,"aliases":227,"sourceIds":230,"published":231,"modified":232,"checkedAt":7,"severity":233,"references":237,"versionKeys":255,"packageCount":32,"repositoryCount":137},"ghsa-2g6r-c272-w58r-4bbbcb01","LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages",[228,229],"CVE-2026-26013","PYSEC-2026-2562",[97,229],"2026-02-11T14:23:13Z","2026-07-13T16:43:30.756724986Z",[234],{"type":235,"score":236},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[238,241,244,246,249,251,253],{"type":239,"url":240},"WEB","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",{"type":242,"url":243},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26013",{"type":239,"url":245},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F2b4b1dc29a833d4053deba4c2b77a3848c834565",{"type":247,"url":248},"PACKAGE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain",{"type":239,"url":250},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.11",{"type":247,"url":252},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-core",{"type":242,"url":254},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",[256,257],"pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7",{"id":98,"slug":259,"dossier":45,"summary":260,"aliases":261,"sourceIds":266,"published":267,"modified":268,"checkedAt":7,"severity":269,"references":272,"versionKeys":287,"packageCount":95,"repositoryCount":95},"ghsa-3644-q5cj-c5c7-4c578cf2","LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",[262,263,264,265],"CVE-2026-45134","PYSEC-2026-2555","PYSEC-2026-2560","PYSEC-2026-2582",[98,263,264,265],"2026-05-13T15:29:30Z","2026-07-13T16:43:39.736848907Z",[270],{"type":235,"score":271},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[273,275,277,279,281,283,285],{"type":239,"url":274},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":242,"url":276},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45134",{"type":247,"url":278},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk",{"type":247,"url":280},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain",{"type":242,"url":282},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":247,"url":284},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-classic",{"type":247,"url":286},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangsmith",[288,289,290,291],"pypi:langchain-classic@1.0.1","pypi:langchain@0.2.7","pypi:langchain@0.3.7","pypi:langsmith@0.6.4",{"id":99,"slug":293,"dossier":45,"summary":294,"aliases":295,"sourceIds":298,"published":299,"modified":300,"checkedAt":7,"severity":301,"references":304,"versionKeys":319,"packageCount":32,"repositoryCount":32},"ghsa-5chr-fjjv-38qv-5f3dd755","langchain-core allows unauthorized users to read arbitrary files from the host file system",[296,297],"CVE-2024-10940","PYSEC-2026-1517",[99,297],"2025-03-20T12:32:41Z","2026-07-07T17:56:35.905913395Z",[302],{"type":235,"score":303},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[305,307,309,311,313,314,316,317],{"type":242,"url":306},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-10940",{"type":239,"url":308},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F7d481f10102f43559cc57bcad7eba291067939ee",{"type":239,"url":310},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc1e742347f9701aadba8920e4d1f79a636e50b68",{"type":239,"url":312},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fe711034713259ae448981bc0fd1d7a5671499c31",{"type":247,"url":248},{"type":239,"url":315},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fbe1ee1cb-2147-4ff4-a57b-b6045271cf27",{"type":247,"url":252},{"type":242,"url":318},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5chr-fjjv-38qv",[256],{"id":100,"slug":321,"dossier":45,"summary":322,"aliases":323,"sourceIds":326,"published":327,"modified":328,"checkedAt":7,"severity":329,"references":333,"versionKeys":346,"packageCount":32,"repositoryCount":32},"ghsa-6qv9-48xg-fc7f-6f0bc426","LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",[324,325],"CVE-2025-65106","PYSEC-2026-1518",[100,325],"2025-11-20T17:42:12Z","2026-07-07T17:57:16.939269197Z",[330],{"type":331,"score":332},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[334,336,338,340,342,343,344],{"type":239,"url":335},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",{"type":242,"url":337},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-65106",{"type":239,"url":339},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc4b6ba254e1a49ed91f2e268e6484011c540542a",{"type":239,"url":341},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Ffa7789d6c21222b85211755d822ef698d3b34e00",{"type":247,"url":248},{"type":247,"url":252},{"type":242,"url":345},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",[256],{"id":101,"slug":348,"dossier":45,"summary":349,"aliases":350,"sourceIds":353,"published":354,"modified":355,"checkedAt":7,"severity":356,"references":359,"versionKeys":380,"packageCount":32,"repositoryCount":137},"ghsa-926x-3r5x-gfhw-b7d12e65","LangChain has incomplete f-string validation in prompt templates",[351,352],"CVE-2026-40087","PYSEC-2026-2563",[101,352],"2026-04-08T21:51:32Z","2026-07-13T16:42:42.901211235Z",[357],{"type":235,"score":358},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[360,362,364,366,368,370,372,373,375,377,378],{"type":239,"url":361},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",{"type":242,"url":363},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40087",{"type":239,"url":365},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36612",{"type":239,"url":367},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36613",{"type":239,"url":369},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F6bab0ba3c12328008ddca3e0d54ff5a6151cd27b",{"type":239,"url":371},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Faf2ed47c6f008cdd551f3c0d87db3774c8dfe258",{"type":247,"url":248},{"type":239,"url":374},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.84",{"type":239,"url":376},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.28",{"type":247,"url":252},{"type":242,"url":379},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",[256,257],{"id":102,"slug":382,"dossier":45,"summary":383,"aliases":384,"sourceIds":387,"published":388,"modified":389,"checkedAt":7,"severity":390,"references":393,"versionKeys":414,"packageCount":32,"repositoryCount":32},"ghsa-c67j-w6g6-q2cm-a4c5c0cf","LangChain serialization injection vulnerability enables secret extraction in dumps\u002Floads APIs",[385,386],"CVE-2025-68664","PYSEC-2026-373",[102,386],"2025-12-23T18:46:13Z","2026-07-02T13:00:05.018724776Z",[391],{"type":235,"score":392},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:L\u002FA:N",[394,396,398,400,402,404,406,407,409,411,412],{"type":239,"url":395},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",{"type":242,"url":397},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68664",{"type":239,"url":399},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34455",{"type":239,"url":401},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34458",{"type":239,"url":403},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8",{"type":239,"url":405},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fd9ec4c5cc78960abd37da79b0250f5642e6f0ce6",{"type":247,"url":248},{"type":239,"url":408},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.81",{"type":239,"url":410},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.5",{"type":247,"url":252},{"type":242,"url":413},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",[256],{"id":103,"slug":416,"dossier":45,"summary":417,"aliases":418,"sourceIds":421,"published":422,"modified":423,"checkedAt":7,"severity":424,"references":429,"versionKeys":438,"packageCount":32,"repositoryCount":95},"ghsa-g48c-2wqr-h844-48f35247","LangGraph checkpoint loading has unsafe msgpack deserialization",[419,420],"CVE-2026-28277","PYSEC-2026-83",[103,420],"2026-03-05T20:16:15.677Z","2026-06-06T01:00:08.116125988Z",[425,427],{"type":235,"score":426},"CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":235,"score":428},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[430,432,434,436],{"type":242,"url":431},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-g48c-2wqr-h844",{"type":242,"url":433},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28277",{"type":247,"url":435},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph",{"type":239,"url":437},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-83.yaml",[439,440,441],"pypi:langgraph@0.1.1","pypi:langgraph@0.3.21","pypi:langgraph@1.0.6",{"id":104,"slug":443,"dossier":45,"summary":444,"aliases":445,"sourceIds":449,"published":450,"modified":451,"checkedAt":7,"severity":452,"references":457,"versionKeys":466,"packageCount":32,"repositoryCount":95},"ghsa-gr75-jv2w-4656-a5b8c61e","LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",[446,447,448],"CVE-2026-55443","PYSEC-2026-2192","PYSEC-2026-2556",[104,447],"2026-06-16T15:03:14Z","2026-08-07T08:11:57.170704540Z",[453,455],{"type":235,"score":454},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":235,"score":456},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[458,460,462,465],{"type":242,"url":459},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-gr75-jv2w-4656",{"type":242,"url":461},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55443",{"type":463,"url":464},"FIX","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fdcaf7795a3e6590af55c3ff7bda6add6355e9ea6",{"type":247,"url":248},[289,290,467],"pypi:langchain@1.2.6",{"id":105,"slug":469,"dossier":45,"summary":470,"aliases":471,"sourceIds":474,"published":475,"modified":476,"checkedAt":7,"severity":477,"references":480,"versionKeys":489,"packageCount":32,"repositoryCount":137},"ghsa-pjwx-r37v-7724-2297a72a","LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists",[472,473],"CVE-2026-44843","PYSEC-2026-2564",[105,473],"2026-05-08T23:07:32Z","2026-07-13T16:42:39.210995356Z",[478],{"type":235,"score":479},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[481,483,485,486,487],{"type":239,"url":482},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",{"type":242,"url":484},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44843",{"type":247,"url":248},{"type":247,"url":252},{"type":242,"url":488},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",[256,257],{"id":106,"slug":491,"dossier":45,"summary":492,"aliases":493,"sourceIds":496,"published":497,"modified":498,"checkedAt":7,"severity":499,"references":502,"versionKeys":524,"packageCount":32,"repositoryCount":137},"ghsa-qh6h-p6c9-ff54-caf42ff5","LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",[494,495],"CVE-2026-34070","PYSEC-2026-2193",[106,495],"2026-03-27T19:45:00Z","2026-07-13T07:26:33.913236655Z",[500],{"type":235,"score":501},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[503,506,508,510,511,513,515,517,519,521],{"type":504,"url":505},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-qh6h-p6c9-ff54",{"type":242,"url":507},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34070",{"type":463,"url":509},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F27add913474e01e33bededf4096151130ba0d47c",{"type":247,"url":248},{"type":242,"url":512},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core==1.2.22",{"type":239,"url":514},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34070",{"type":239,"url":516},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34070.json",{"type":242,"url":518},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24766",{"type":242,"url":520},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":522,"url":523},"REPORT","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2453287",[256,257],{"id":107,"slug":526,"dossier":45,"summary":527,"aliases":528,"sourceIds":531,"published":532,"modified":533,"checkedAt":7,"severity":534,"references":537,"versionKeys":545,"packageCount":32,"repositoryCount":95},"ghsa-r7w7-9xr2-qq2r-7a3a0a91","langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding",[529,530],"CVE-2026-41488","PYSEC-2026-76",[107,530],"2026-04-16T23:00:12Z","2026-06-06T01:15:07.912179267Z",[535],{"type":235,"score":536},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[538,540,542,543],{"type":242,"url":539},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-r7w7-9xr2-qq2r",{"type":242,"url":541},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41488",{"type":247,"url":248},{"type":239,"url":544},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flangchain-openai\u002FPYSEC-2026-76.yaml",[546,547,548],"pypi:langchain-openai@0.2.8","pypi:langchain-openai@1.1.7","pypi:langchain-openai@1.1.9",{"id":108,"slug":550,"dossier":45,"summary":551,"aliases":552,"sourceIds":556,"published":557,"modified":558,"checkedAt":7,"severity":559,"references":564,"versionKeys":580,"packageCount":137,"repositoryCount":137},"ghsa-w39p-vh2g-g8g5-47880dfe","LangGraph SDK has unsafe URL path construction",[553,554,555],"CVE-2026-48776","PYSEC-2026-2194","PYSEC-2026-2575",[108,554,555],"2026-06-17T10:55:15.113Z","2026-07-21T15:15:50.659527533Z",[560,562],{"type":235,"score":561},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":235,"score":563},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[565,567,569,571,572,574,576,578],{"type":239,"url":566},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":242,"url":568},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48776",{"type":242,"url":570},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":247,"url":435},{"type":239,"url":573},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Freleases\u002Ftag\u002Fsdk%3D%3D0.3.15",{"type":239,"url":575},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph-sdk\u002FPYSEC-2026-2575.yaml",{"type":239,"url":577},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-2194.yaml",{"type":247,"url":579},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flanggraph-sdk",[581,439],"pypi:langgraph-sdk@0.3.3",{"id":109,"slug":583,"dossier":45,"summary":131,"aliases":584,"sourceIds":588,"published":589,"modified":590,"checkedAt":7,"severity":591,"references":594,"versionKeys":599,"packageCount":32,"repositoryCount":32},"pysec-2024-323-1dd96856",[585,586,587],"CVE-2024-5998","GHSA-f2jm-rw3h-6phg","PYSEC-2026-1514",[109],"2024-09-17T12:15:02.977Z","2026-07-13T07:26:23.643495355Z",[592],{"type":235,"score":593},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[595,597],{"type":463,"url":596},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F604dfe2d99246b0c09f047c604f0c63eafba31e7",{"type":504,"url":598},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Ffa3a2753-57c3-4e08-a176-d7a3ffda28fe",[289],1786588640364]