L
Vendor security profile
langchain
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical2
CISA KEV0
Public exploit5
Patch rate%22
Avg. CVSS7.3
12-month vulnerability rate
0
1
1
0
1
2
1
0
0
0
0
2
CVE KEV
CVE severity distribution
9toplam CVE
Critical2 (22%)
High4 (44%)
Medium2 (22%)
Low1 (11%)
Patch and exploitation view
%22
Verified patch
%0
CISA KEV
%56
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
6.0
CVE-2026-106119
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
L
Patch status unknownEPSS %0
2.3
CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
L
Patch status unknownEPSS %0
7.6
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
L
Patch status unknownEPSS %0
7.7
CVE-2026-55253
LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
L
Patch verifiedEPSS %1
5.9
CVE-2026-55235
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
L
Patch verifiedEPSS %0
5.9
CVE-2026-55236
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
L
Patch verifiedEPSS %0
8.6
CVE-2026-72848
langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery
L
Patch status unknownEPSS %1
5.3
CVE-2026-71433
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
L
Patch verifiedEPSS %0
6.7
CVE-2026-48121
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
L
Patch status unknownEPSS %0
8.2
CVE-2026-44843
Deserialization of untrusted data in Langchain
L
Patch status unknownEPSS %0