L
Vendor security profile
langchain-ai
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical0
CISA KEV0
Public exploit2
Patch rate%50
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
0
1
0
0
0
0
3
3
3
CVE KEV
CVE severity distribution
10toplam CVE
High4 (40%)
Medium5 (50%)
Low1 (10%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%20
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
6.0
CVE-2026-106119
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
L
Patch status unknownEPSS %0
2.3
CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
L
Patch status unknownEPSS %0
7.6
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
L
Patch status unknownEPSS %0
7.7
CVE-2026-55253
LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
L
Patch verifiedEPSS %1
5.9
CVE-2026-55235
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
L
Patch verifiedEPSS %0
5.9
CVE-2026-55236
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
L
Patch verifiedEPSS %0
8.6
CVE-2026-72848
langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery
L
Patch status unknownEPSS %1
5.3
CVE-2026-71433
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
L
Patch verifiedEPSS %0
6.7
CVE-2026-48121
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
L
Patch status unknownEPSS %0
7.5
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
L
Patch verifiedEPSS %1